diff options
Diffstat (limited to 'main/musl')
| -rw-r--r-- | main/musl/0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch | 73 | ||||
| -rw-r--r-- | main/musl/APKBUILD | 6 |
2 files changed, 78 insertions, 1 deletions
diff --git a/main/musl/0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch b/main/musl/0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch new file mode 100644 index 0000000000..2b8316c389 --- /dev/null +++ b/main/musl/0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch @@ -0,0 +1,73 @@ +From c3edc06d1e1360f3570db9155d6b318ae0d0f0f7 Mon Sep 17 00:00:00 2001 +From: Rich Felker <dalias@aerifal.cx> +Date: Thu, 6 Oct 2016 18:34:58 -0400 +Subject: [PATCH] fix missing integer overflow checks in regexec buffer size + computations + +most of the possible overflows were already ruled out in practice by +regcomp having already succeeded performing larger allocations. +however at least the num_states*num_tags multiplication can clearly +overflow in practice. for safety, check them all, and use the proper +type, size_t, rather than int. + +also improve comments, use calloc in place of malloc+memset, and +remove bogus casts. +--- + src/regex/regexec.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/src/regex/regexec.c b/src/regex/regexec.c +index 16c5d0a..dd52319 100644 +--- a/src/regex/regexec.c ++++ b/src/regex/regexec.c +@@ -34,6 +34,7 @@ + #include <wchar.h> + #include <wctype.h> + #include <limits.h> ++#include <stdint.h> + + #include <regex.h> + +@@ -206,11 +207,24 @@ tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, + + /* Allocate memory for temporary data required for matching. This needs to + be done for every matching operation to be thread safe. This allocates +- everything in a single large block from the stack frame using alloca() +- or with malloc() if alloca is unavailable. */ ++ everything in a single large block with calloc(). */ + { +- int tbytes, rbytes, pbytes, xbytes, total_bytes; ++ size_t tbytes, rbytes, pbytes, xbytes, total_bytes; + char *tmp_buf; ++ ++ /* Ensure that tbytes and xbytes*num_states cannot overflow, and that ++ * they don't contribute more than 1/8 of SIZE_MAX to total_bytes. */ ++ if (num_tags > SIZE_MAX/(8 * sizeof(int) * tnfa->num_states)) ++ goto error_exit; ++ ++ /* Likewise check rbytes. */ ++ if (tnfa->num_states+1 > SIZE_MAX/(8 * sizeof(*reach_next))) ++ goto error_exit; ++ ++ /* Likewise check pbytes. */ ++ if (tnfa->num_states > SIZE_MAX/(8 * sizeof(*reach_pos))) ++ goto error_exit; ++ + /* Compute the length of the block we need. */ + tbytes = sizeof(*tmp_tags) * num_tags; + rbytes = sizeof(*reach_next) * (tnfa->num_states + 1); +@@ -221,10 +235,9 @@ tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, + + (rbytes + xbytes * tnfa->num_states) * 2 + tbytes + pbytes; + + /* Allocate the memory. */ +- buf = xmalloc((unsigned)total_bytes); ++ buf = calloc(total_bytes, 1); + if (buf == NULL) + return REG_ESPACE; +- memset(buf, 0, (size_t)total_bytes); + + /* Get the various pointers within tmp_buf (properly aligned). */ + tmp_tags = (void *)buf; +-- +2.10.0 + diff --git a/main/musl/APKBUILD b/main/musl/APKBUILD index c794a6eddc..2e90620cc7 100644 --- a/main/musl/APKBUILD +++ b/main/musl/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Timo Teräs <timo.teras@iki.fi> pkgname=musl pkgver=1.1.15 -pkgrel=3 +pkgrel=4 pkgdesc="the musl c library (libc) implementation" url="http://www.musl-libc.org/" arch="all" @@ -15,6 +15,7 @@ subpackages="$pkgname-dev $pkgname-dbg libc6-compat:compat" source="http://www.musl-libc.org/releases/musl-$pkgver.tar.gz 0001-fix-asctime-day-month-names-not-to-vary-by-locale.patch 0001-use-dynamic-buffer-for-getmntent.patch + 0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch ldconfig __stack_chk_fail_local.c @@ -125,6 +126,7 @@ compat() { md5sums="9590a9d47ee64f220b3c12f7afb864ca musl-1.1.15.tar.gz c08825383e41e5dbcd3ffdfd2062dd47 0001-fix-asctime-day-month-names-not-to-vary-by-locale.patch c6b8732eea4642112c56f45ff00e356a 0001-use-dynamic-buffer-for-getmntent.patch +fe6de41e930775994f64b772f1fdc45c 0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch 830d01f7821b978df770b06db3790921 ldconfig 0df687757221bbb0fc1aa67f1bd646f9 __stack_chk_fail_local.c 57ef2c63b9ec6a2041694ace97d4ffa2 getconf.c @@ -133,6 +135,7 @@ c6b8732eea4642112c56f45ff00e356a 0001-use-dynamic-buffer-for-getmntent.patch sha256sums="97e447c7ee2a7f613186ec54a93054fe15469fe34d7d323080f7ef38f5ecb0fa musl-1.1.15.tar.gz d157100aeed5b0866eb6d50288f63f26ea9900f1d4c7b8a1492294c912b5cc19 0001-fix-asctime-day-month-names-not-to-vary-by-locale.patch e1671e2436954f2eec0d2f49dd53e9e66ff0106c9c017a7ff69d35bdb7051055 0001-use-dynamic-buffer-for-getmntent.patch +cec3fdd3a90f153a2c5a5d22ffd7429c14ecb105259a9c2540e46db6cfe71b55 0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch b4a2c06db38742e8c42c3c9838b285a7d8cdac6c091ff3df5ff9a15f1e41b9c7 ldconfig 299a7d75a09de3e2e11e7fb4acc3182e4a14e868093d2f30938fce9bfcff13da __stack_chk_fail_local.c d87d0cbb3690ae2c5d8cc218349fd8278b93855dd625deaf7ae50e320aad247c getconf.c @@ -141,6 +144,7 @@ f79a2930a2e5bb0624321589edf8b889d1e9b603e01e6b7ae214616605b3fdd7 iconv.c" sha512sums="9e923572c0d6bad3dc2d2646d4b0699c10b477ce6300ac6c6224895192a90667f581ddf6eda2ab8c4c16f47bde4bccb03bb90478638d136d9df721430f4d0163 musl-1.1.15.tar.gz 1a74d5f5e0f6f2fe6029ed0f18b4603f80c990f19aa13d83c5d1f40f032b2ffb3819aae13ae1f96415bb08571774eec164e71d09028f2a5db4ae9b77e48cafe7 0001-fix-asctime-day-month-names-not-to-vary-by-locale.patch a25ff6c640fed110c124f2b12920111befa832202b906649e1d21613dda32b55bada0d59b310f4af2d4ae27c9ce2c92079ba1c919b4898c002f271c7a0c04878 0001-use-dynamic-buffer-for-getmntent.patch +6376167c67fdd22c0c4476fc38ff89ae3ce46435f72d7c506460944dd8f7d9153eed9696738dff5b320f09b474964f2a57394530eb40197ad58a6956e87e68ff 0001-fix-missing-integer-overflow-checks-in-regexec-buffe.patch 8d3a2d5315fc56fee7da9abb8b89bb38c6046c33d154c10d168fb35bfde6b0cf9f13042a3bceee34daf091bc409d699223735dcf19f382eeee1f6be34154f26f ldconfig 062bb49fa54839010acd4af113e20f7263dde1c8a2ca359b5fb2661ef9ed9d84a0f7c3bc10c25dcfa10bb3c5a4874588dff636ac43d5dbb3d748d75400756d0b __stack_chk_fail_local.c 0d80f37b34a35e3d14b012257c50862dfeb9d2c81139ea2dfa101d981d093b009b9fa450ba27a708ac59377a48626971dfc58e20a3799084a65777a0c32cbc7d getconf.c |