Hello,
the following diff addresses CVE-2012-3509
(libiberty: integer overflow, leading to heap-buffer overflow).
Index: include/objalloc.h
===================================================================
RCS file: /cvs/src/gnu/lib/libiberty/include/objalloc.h,v
retrieving revision 1.1.1.3
diff -u -p -u -p -r1.1.1.3 objalloc.h
--- include/objalloc.h 27 May 2008 18:46:00 -0000 1.1.1.3
+++ include/objalloc.h 3 Feb 2014 13:24:24 -0000
@@ -91,7 +91,7 @@ extern void *_objalloc_alloc (struct obj
if (__len == 0) \
__len = 1; \
__len = (__len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1); \
- (__len <= __o->current_space \
+ (__len != 0 && __len <= __o->current_space \
? (__o->current_ptr += __len, \
__o->current_space -= __len, \
(void *) (__o->current_ptr - __len)) \
Index: src/objalloc.c
===================================================================
RCS file: /cvs/src/gnu/lib/libiberty/src/objalloc.c,v
retrieving revision 1.4
diff -u -p -u -p -r1.4 objalloc.c
--- src/objalloc.c 27 May 2008 18:52:44 -0000 1.4
+++ src/objalloc.c 3 Feb 2014 13:24:24 -0000
@@ -112,14 +112,21 @@ objalloc_create (void)
/* Allocate space from an objalloc structure. */
PTR
-_objalloc_alloc (struct objalloc *o, unsigned long len)
+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
{
+ unsigned long len = original_len;
+
/* We avoid confusion from zero sized objects by always allocating
at least 1 byte. */
if (len == 0)
len = 1;
len = (len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1);
+
+ /* CVE-2012-3509: Check for overflow in the alignment operation above
+ * and then malloc argument below. */
+ if (len + CHUNK_HEADER_SIZE < original_len)
+ return NULL;
if (len <= o->current_space)
{
No functional changes, therefore no bump of "shlib_version".
Cheers,
Sebastian
[1] http://www.openwall.com/lists/oss-security/2012/08/29/3
[2] http://gcc.gnu.org/viewcvs/gcc?view=revision&revision=191413
