Re: [OE-core] [PATCH V2] nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10016 & CVE-2018-10316
On 2018年08月21日 14:15, Hongxu Jia wrote:
Sorry for the error,
It seems the fix of CVE-2018-10016 is incorrect, I will remove it.
I report the status of CVE-2018-10016 to upstream
https://bugzilla.nasm.us/show_bug.cgi?id=3392473
//Hongxu
V3 incoming
//Hongxu
On 2018年08月21日 11:48, ChenQi wrote:
Caused ovmf do_compile failure.
https://autobuilder.yocto.io/builders/nightly-musl/builds/1254/steps/BuildImages/logs/stdio
Best Regards,
Chen Qi
On 08/20/2018 09:23 AM, Hongxu Jia wrote:
Signed-off-by: Hongxu Jia
---
...t-we-are-not-reading-past-end-of-a-buffer.patch | 65
++
...001-asm-eval.c-Avoid-possible-divide-by-0.patch | 40 +
.../0001-assemble-Check-global-line-limit.patch | 50
+
.../nasm/nasm/0001-fix-CVE-2018-8882.patch | 30 ++
meta/recipes-devtools/nasm/nasm_2.13.03.bb | 4 ++
5 files changed, 189 insertions(+)
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
new file mode 100644
index 000..a56a08b
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
@@ -0,0 +1,65 @@
+From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:48:17 +0800
+Subject: [PATCH] Verify that we are not reading past end of a buffer
+
+Simple reproducer is just,
+
+ ret :ep
+
+which triggers a buffer overread due to parsing of an invalid
+segment override.
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted
[https://bugzilla.nasm.us/show_bug.cgi?id=3392447]
+CVE: CVE-2018-8883
+Signed-off-by: Hongxu Jia
+---
+ include/opflags.h | 2 +-
+ include/tables.h | 1 +
+ x86/regs.pl | 3 ++-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/opflags.h b/include/opflags.h
+index ef2838c1..8d4b6b1e 100644
+--- a/include/opflags.h
b/include/opflags.h
+@@ -166,7 +166,7 @@
+ #define REG_CLASS_BND GEN_REG_CLASS(9)
+
+ #define is_class(class, op) (!((opflags_t)(class) &
~(opflags_t)(op)))
+-#define is_reg_class(class, reg) is_class((class),
nasm_reg_flags[(reg)])
++#define is_reg_class(class, reg) is_class((class), ((reg) <
nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0))
+
+ #define IS_SREG(reg) is_reg_class(REG_SREG, (reg))
+ #define IS_FSGS(reg) is_reg_class(REG_FSGS, (reg))
+diff --git a/include/tables.h b/include/tables.h
+index 24a665e2..458752ce 100644
+--- a/include/tables.h
b/include/tables.h
+@@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[];
+ typedef uint64_t opflags_t;
+ typedef uint16_t decoflags_t;
+ extern const opflags_t nasm_reg_flags[];
++extern const size_t nasm_reg_flags_size;
+ /* regvals.c */
+ extern const int nasm_regvals[];
+
+diff --git a/x86/regs.pl b/x86/regs.pl
+index 3a1b56f5..cb5cea68 100755
+--- a/x86/regs.pl
b/x86/regs.pl
+@@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) {
+ printf " %-15s /* %-5s */\n",
+ $regs{$reg}.',', $reg;
+ }
+- print "};\n";
++ print "};\n\n";
++ print "const size_t nasm_reg_flags_size =
sizeof(nasm_reg_flags) / sizeof(opflags_t);\n";
+ } elsif ( $fmt eq 'vc' ) {
+ # Output regvals.c
+ print "/* automatically generated from $file - do not edit
*/\n\n";
+--
+2.17.1
+
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
new file mode 100644
index 000..6ceeca0
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
@@ -0,0 +1,40 @@
+From 8ad049cf9ccda2a5133a97506011862bcfc4a0c0 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:15:35 +0800
+Subject: [PATCH] asm/eval.c: Avoid possible divide by 0
+
+During a divide operation, we already tested that the
+divisor has is_simple, but then when testing it for 0,
+we again verify that it does not contain any unknown parts.
+This extra check prevents detection of cases when
+reloc_value returns 0.
+
+Use reloc_value instead in detection of 0 divisor.
+
+https://bugzilla.nasm.us/show_bug.cgi?id=3392473
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted
[https://bugzilla.nasm.us/show_bug.cgi?id=3392473]
+CVE: CVE-2018-10016
+Signed-off-by: Hongxu Jia
+---
+ asm/eval.c | 2 +-
+ 1 file changed, 1
Re: [OE-core] [PATCH V2] nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10016 & CVE-2018-10316
Sorry for the error,
It seems the fix of CVE-2018-10016 is incorrect, I will remove it.
V3 incoming
//Hongxu
On 2018年08月21日 11:48, ChenQi wrote:
Caused ovmf do_compile failure.
https://autobuilder.yocto.io/builders/nightly-musl/builds/1254/steps/BuildImages/logs/stdio
Best Regards,
Chen Qi
On 08/20/2018 09:23 AM, Hongxu Jia wrote:
Signed-off-by: Hongxu Jia
---
...t-we-are-not-reading-past-end-of-a-buffer.patch | 65
++
...001-asm-eval.c-Avoid-possible-divide-by-0.patch | 40 +
.../0001-assemble-Check-global-line-limit.patch | 50
+
.../nasm/nasm/0001-fix-CVE-2018-8882.patch | 30 ++
meta/recipes-devtools/nasm/nasm_2.13.03.bb | 4 ++
5 files changed, 189 insertions(+)
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
new file mode 100644
index 000..a56a08b
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
@@ -0,0 +1,65 @@
+From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:48:17 +0800
+Subject: [PATCH] Verify that we are not reading past end of a buffer
+
+Simple reproducer is just,
+
+ ret :ep
+
+which triggers a buffer overread due to parsing of an invalid
+segment override.
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted
[https://bugzilla.nasm.us/show_bug.cgi?id=3392447]
+CVE: CVE-2018-8883
+Signed-off-by: Hongxu Jia
+---
+ include/opflags.h | 2 +-
+ include/tables.h | 1 +
+ x86/regs.pl | 3 ++-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/opflags.h b/include/opflags.h
+index ef2838c1..8d4b6b1e 100644
+--- a/include/opflags.h
b/include/opflags.h
+@@ -166,7 +166,7 @@
+ #define REG_CLASS_BND GEN_REG_CLASS(9)
+
+ #define is_class(class, op) (!((opflags_t)(class) &
~(opflags_t)(op)))
+-#define is_reg_class(class, reg) is_class((class),
nasm_reg_flags[(reg)])
++#define is_reg_class(class, reg) is_class((class), ((reg) <
nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0))
+
+ #define IS_SREG(reg) is_reg_class(REG_SREG, (reg))
+ #define IS_FSGS(reg) is_reg_class(REG_FSGS, (reg))
+diff --git a/include/tables.h b/include/tables.h
+index 24a665e2..458752ce 100644
+--- a/include/tables.h
b/include/tables.h
+@@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[];
+ typedef uint64_t opflags_t;
+ typedef uint16_t decoflags_t;
+ extern const opflags_t nasm_reg_flags[];
++extern const size_t nasm_reg_flags_size;
+ /* regvals.c */
+ extern const int nasm_regvals[];
+
+diff --git a/x86/regs.pl b/x86/regs.pl
+index 3a1b56f5..cb5cea68 100755
+--- a/x86/regs.pl
b/x86/regs.pl
+@@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) {
+ printf " %-15s /* %-5s */\n",
+ $regs{$reg}.',', $reg;
+ }
+- print "};\n";
++ print "};\n\n";
++ print "const size_t nasm_reg_flags_size =
sizeof(nasm_reg_flags) / sizeof(opflags_t);\n";
+ } elsif ( $fmt eq 'vc' ) {
+ # Output regvals.c
+ print "/* automatically generated from $file - do not edit
*/\n\n";
+--
+2.17.1
+
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
new file mode 100644
index 000..6ceeca0
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
@@ -0,0 +1,40 @@
+From 8ad049cf9ccda2a5133a97506011862bcfc4a0c0 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:15:35 +0800
+Subject: [PATCH] asm/eval.c: Avoid possible divide by 0
+
+During a divide operation, we already tested that the
+divisor has is_simple, but then when testing it for 0,
+we again verify that it does not contain any unknown parts.
+This extra check prevents detection of cases when
+reloc_value returns 0.
+
+Use reloc_value instead in detection of 0 divisor.
+
+https://bugzilla.nasm.us/show_bug.cgi?id=3392473
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted
[https://bugzilla.nasm.us/show_bug.cgi?id=3392473]
+CVE: CVE-2018-10016
+Signed-off-by: Hongxu Jia
+---
+ asm/eval.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/asm/eval.c b/asm/eval.c
+index 816983b9..57c598c5 100644
+--- a/asm/eval.c
b/asm/eval.c
+@@ -585,7 +585,7 @@ static
Re: [OE-core] [PATCH V2] nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10016 & CVE-2018-10316
Caused ovmf do_compile failure.
https://autobuilder.yocto.io/builders/nightly-musl/builds/1254/steps/BuildImages/logs/stdio
Best Regards,
Chen Qi
On 08/20/2018 09:23 AM, Hongxu Jia wrote:
Signed-off-by: Hongxu Jia
---
...t-we-are-not-reading-past-end-of-a-buffer.patch | 65 ++
...001-asm-eval.c-Avoid-possible-divide-by-0.patch | 40 +
.../0001-assemble-Check-global-line-limit.patch| 50 +
.../nasm/nasm/0001-fix-CVE-2018-8882.patch | 30 ++
meta/recipes-devtools/nasm/nasm_2.13.03.bb | 4 ++
5 files changed, 189 insertions(+)
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
new file mode 100644
index 000..a56a08b
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
@@ -0,0 +1,65 @@
+From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:48:17 +0800
+Subject: [PATCH] Verify that we are not reading past end of a buffer
+
+Simple reproducer is just,
+
+ret :ep
+
+which triggers a buffer overread due to parsing of an invalid
+segment override.
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392447]
+CVE: CVE-2018-8883
+Signed-off-by: Hongxu Jia
+---
+ include/opflags.h | 2 +-
+ include/tables.h | 1 +
+ x86/regs.pl | 3 ++-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/opflags.h b/include/opflags.h
+index ef2838c1..8d4b6b1e 100644
+--- a/include/opflags.h
b/include/opflags.h
+@@ -166,7 +166,7 @@
+ #define REG_CLASS_BND GEN_REG_CLASS(9)
+
+ #define is_class(class, op) (!((opflags_t)(class) & ~(opflags_t)(op)))
+-#define is_reg_class(class, reg)is_class((class), nasm_reg_flags[(reg)])
++#define is_reg_class(class, reg)is_class((class), ((reg) <
nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0))
+
+ #define IS_SREG(reg)is_reg_class(REG_SREG, (reg))
+ #define IS_FSGS(reg)is_reg_class(REG_FSGS, (reg))
+diff --git a/include/tables.h b/include/tables.h
+index 24a665e2..458752ce 100644
+--- a/include/tables.h
b/include/tables.h
+@@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[];
+ typedef uint64_t opflags_t;
+ typedef uint16_t decoflags_t;
+ extern const opflags_t nasm_reg_flags[];
++extern const size_t nasm_reg_flags_size;
+ /* regvals.c */
+ extern const int nasm_regvals[];
+
+diff --git a/x86/regs.pl b/x86/regs.pl
+index 3a1b56f5..cb5cea68 100755
+--- a/x86/regs.pl
b/x86/regs.pl
+@@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) {
+ printf "%-15s /* %-5s */\n",
+ $regs{$reg}.',', $reg;
+ }
+-print "};\n";
++print "};\n\n";
++print "const size_t nasm_reg_flags_size = sizeof(nasm_reg_flags) /
sizeof(opflags_t);\n";
+ } elsif ( $fmt eq 'vc' ) {
+ # Output regvals.c
+ print "/* automatically generated from $file - do not edit */\n\n";
+--
+2.17.1
+
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
new file mode 100644
index 000..6ceeca0
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
@@ -0,0 +1,40 @@
+From 8ad049cf9ccda2a5133a97506011862bcfc4a0c0 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:15:35 +0800
+Subject: [PATCH] asm/eval.c: Avoid possible divide by 0
+
+During a divide operation, we already tested that the
+divisor has is_simple, but then when testing it for 0,
+we again verify that it does not contain any unknown parts.
+This extra check prevents detection of cases when
+reloc_value returns 0.
+
+Use reloc_value instead in detection of 0 divisor.
+
+https://bugzilla.nasm.us/show_bug.cgi?id=3392473
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392473]
+CVE: CVE-2018-10016
+Signed-off-by: Hongxu Jia
+---
+ asm/eval.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/asm/eval.c b/asm/eval.c
+index 816983b9..57c598c5 100644
+--- a/asm/eval.c
b/asm/eval.c
+@@ -585,7 +585,7 @@ static expr *expr5(int critical)
+ " scalar values");
+ return NULL;
+ }
+-if (j != '*' && !is_unknown(f) && reloc_value(f)
[OE-core] [PATCH V2] nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10016 & CVE-2018-10316
Signed-off-by: Hongxu Jia
---
...t-we-are-not-reading-past-end-of-a-buffer.patch | 65 ++
...001-asm-eval.c-Avoid-possible-divide-by-0.patch | 40 +
.../0001-assemble-Check-global-line-limit.patch| 50 +
.../nasm/nasm/0001-fix-CVE-2018-8882.patch | 30 ++
meta/recipes-devtools/nasm/nasm_2.13.03.bb | 4 ++
5 files changed, 189 insertions(+)
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
create mode 100644
meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
create mode 100644 meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
new file mode 100644
index 000..a56a08b
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
@@ -0,0 +1,65 @@
+From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:48:17 +0800
+Subject: [PATCH] Verify that we are not reading past end of a buffer
+
+Simple reproducer is just,
+
+ret :ep
+
+which triggers a buffer overread due to parsing of an invalid
+segment override.
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392447]
+CVE: CVE-2018-8883
+Signed-off-by: Hongxu Jia
+---
+ include/opflags.h | 2 +-
+ include/tables.h | 1 +
+ x86/regs.pl | 3 ++-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/opflags.h b/include/opflags.h
+index ef2838c1..8d4b6b1e 100644
+--- a/include/opflags.h
b/include/opflags.h
+@@ -166,7 +166,7 @@
+ #define REG_CLASS_BND GEN_REG_CLASS(9)
+
+ #define is_class(class, op) (!((opflags_t)(class) & ~(opflags_t)(op)))
+-#define is_reg_class(class, reg)is_class((class), nasm_reg_flags[(reg)])
++#define is_reg_class(class, reg)is_class((class), ((reg) <
nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0))
+
+ #define IS_SREG(reg)is_reg_class(REG_SREG, (reg))
+ #define IS_FSGS(reg)is_reg_class(REG_FSGS, (reg))
+diff --git a/include/tables.h b/include/tables.h
+index 24a665e2..458752ce 100644
+--- a/include/tables.h
b/include/tables.h
+@@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[];
+ typedef uint64_t opflags_t;
+ typedef uint16_t decoflags_t;
+ extern const opflags_t nasm_reg_flags[];
++extern const size_t nasm_reg_flags_size;
+ /* regvals.c */
+ extern const int nasm_regvals[];
+
+diff --git a/x86/regs.pl b/x86/regs.pl
+index 3a1b56f5..cb5cea68 100755
+--- a/x86/regs.pl
b/x86/regs.pl
+@@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) {
+ printf "%-15s /* %-5s */\n",
+ $regs{$reg}.',', $reg;
+ }
+-print "};\n";
++print "};\n\n";
++print "const size_t nasm_reg_flags_size = sizeof(nasm_reg_flags) /
sizeof(opflags_t);\n";
+ } elsif ( $fmt eq 'vc' ) {
+ # Output regvals.c
+ print "/* automatically generated from $file - do not edit */\n\n";
+--
+2.17.1
+
diff --git
a/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
new file mode 100644
index 000..6ceeca0
--- /dev/null
+++
b/meta/recipes-devtools/nasm/nasm/0001-asm-eval.c-Avoid-possible-divide-by-0.patch
@@ -0,0 +1,40 @@
+From 8ad049cf9ccda2a5133a97506011862bcfc4a0c0 Mon Sep 17 00:00:00 2001
+From: Adam Majer
+Date: Fri, 17 Aug 2018 14:15:35 +0800
+Subject: [PATCH] asm/eval.c: Avoid possible divide by 0
+
+During a divide operation, we already tested that the
+divisor has is_simple, but then when testing it for 0,
+we again verify that it does not contain any unknown parts.
+This extra check prevents detection of cases when
+reloc_value returns 0.
+
+Use reloc_value instead in detection of 0 divisor.
+
+https://bugzilla.nasm.us/show_bug.cgi?id=3392473
+
+Signed-off-by: Adam Majer
+
+Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392473]
+CVE: CVE-2018-10016
+Signed-off-by: Hongxu Jia
+---
+ asm/eval.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/asm/eval.c b/asm/eval.c
+index 816983b9..57c598c5 100644
+--- a/asm/eval.c
b/asm/eval.c
+@@ -585,7 +585,7 @@ static expr *expr5(int critical)
+ " scalar values");
+ return NULL;
+ }
+-if (j != '*' && !is_unknown(f) && reloc_value(f) == 0) {
++if (j != '*' && reloc_value(f) == 0) {
+ nasm_error(ERR_NONFATAL, "division by zero");
+ return NULL;
+ }
+--
+2.17.1
+
diff --git
