mirror of
https://git.yoctoproject.org/poky
synced 2026-04-28 06:32:34 +02:00
28688a2770
(From OE-Core rev: 4a46516256c24cb30bc9629371816f893693b488) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
117 lines
4.4 KiB
Diff
117 lines
4.4 KiB
Diff
From 3079f7966dbed4497e36d5067cbfd896a90358cb Mon Sep 17 00:00:00 2001
|
|
From: Cyrill Gorcunov <gorcunov@gmail.com>
|
|
Date: Wed, 14 Nov 2018 10:03:42 +0300
|
|
Subject: [PATCH] preproc: Fix malformed parameter count
|
|
|
|
readnum returns 64bit number which may become
|
|
a negative integer upon conversion which in
|
|
turn lead to out of bound array access.
|
|
|
|
Fix it by explicit conversion with bounds check
|
|
|
|
| POC6:2: error: parameter count `2222222222' is out of bounds [0; 2147483647]
|
|
|
|
https://bugzilla.nasm.us/show_bug.cgi?id=3392528
|
|
|
|
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
|
|
|
|
Upstream-Status: Backport
|
|
CVE: CVE-2018-19755
|
|
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
|
|
---
|
|
asm/preproc.c | 43 +++++++++++++++++++++----------------------
|
|
1 file changed, 21 insertions(+), 22 deletions(-)
|
|
|
|
diff --git a/asm/preproc.c b/asm/preproc.c
|
|
index b6afee3..e5ad05a 100644
|
|
--- a/asm/preproc.c
|
|
+++ b/asm/preproc.c
|
|
@@ -1650,6 +1650,23 @@ smacro_defined(Context * ctx, const char *name, int nparam, SMacro ** defn,
|
|
return false;
|
|
}
|
|
|
|
+/* param should be a natural number [0; INT_MAX] */
|
|
+static int read_param_count(const char *str)
|
|
+{
|
|
+ int result;
|
|
+ bool err;
|
|
+
|
|
+ result = readnum(str, &err);
|
|
+ if (result < 0 || result > INT_MAX) {
|
|
+ result = 0;
|
|
+ nasm_error(ERR_NONFATAL, "parameter count `%s' is out of bounds [%d; %d]",
|
|
+ str, 0, INT_MAX);
|
|
+ } else if (err) {
|
|
+ nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", str);
|
|
+ }
|
|
+ return result;
|
|
+}
|
|
+
|
|
/*
|
|
* Count and mark off the parameters in a multi-line macro call.
|
|
* This is called both from within the multi-line macro expansion
|
|
@@ -1871,11 +1888,7 @@ static bool if_condition(Token * tline, enum preproc_token ct)
|
|
pp_directives[ct]);
|
|
} else {
|
|
searching.nparam_min = searching.nparam_max =
|
|
- readnum(tline->text, &j);
|
|
- if (j)
|
|
- nasm_error(ERR_NONFATAL,
|
|
- "unable to parse parameter count `%s'",
|
|
- tline->text);
|
|
+ read_param_count(tline->text);
|
|
}
|
|
if (tline && tok_is_(tline->next, "-")) {
|
|
tline = tline->next->next;
|
|
@@ -1886,11 +1899,7 @@ static bool if_condition(Token * tline, enum preproc_token ct)
|
|
"`%s' expects a parameter count after `-'",
|
|
pp_directives[ct]);
|
|
else {
|
|
- searching.nparam_max = readnum(tline->text, &j);
|
|
- if (j)
|
|
- nasm_error(ERR_NONFATAL,
|
|
- "unable to parse parameter count `%s'",
|
|
- tline->text);
|
|
+ searching.nparam_max = read_param_count(tline->text);
|
|
if (searching.nparam_min > searching.nparam_max) {
|
|
nasm_error(ERR_NONFATAL,
|
|
"minimum parameter count exceeds maximum");
|
|
@@ -2079,8 +2088,6 @@ static void undef_smacro(Context *ctx, const char *mname)
|
|
*/
|
|
static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
|
|
{
|
|
- bool err;
|
|
-
|
|
tline = tline->next;
|
|
skip_white_(tline);
|
|
tline = expand_id(tline);
|
|
@@ -2103,11 +2110,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
|
|
if (!tok_type_(tline, TOK_NUMBER)) {
|
|
nasm_error(ERR_NONFATAL, "`%s' expects a parameter count", directive);
|
|
} else {
|
|
- def->nparam_min = def->nparam_max =
|
|
- readnum(tline->text, &err);
|
|
- if (err)
|
|
- nasm_error(ERR_NONFATAL,
|
|
- "unable to parse parameter count `%s'", tline->text);
|
|
+ def->nparam_min = def->nparam_max = read_param_count(tline->text);
|
|
}
|
|
if (tline && tok_is_(tline->next, "-")) {
|
|
tline = tline->next->next;
|
|
@@ -2117,11 +2120,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
|
|
nasm_error(ERR_NONFATAL,
|
|
"`%s' expects a parameter count after `-'", directive);
|
|
} else {
|
|
- def->nparam_max = readnum(tline->text, &err);
|
|
- if (err) {
|
|
- nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'",
|
|
- tline->text);
|
|
- }
|
|
+ def->nparam_max = read_param_count(tline->text);
|
|
if (def->nparam_min > def->nparam_max) {
|
|
nasm_error(ERR_NONFATAL, "minimum parameter count exceeds maximum");
|
|
def->nparam_max = def->nparam_min;
|
|
--
|
|
2.10.5.GIT
|
|
|