Module Name: src
Committed By: drochner
Date: Thu Oct 25 17:00:17 UTC 2012
Modified Files:
src/external/gpl3/binutils/dist/include: objalloc.h
src/external/gpl3/binutils/dist/libiberty: objalloc.c
src/external/gpl3/gcc/dist/include: objalloc.h
src/external/gpl3/gcc/dist/libiberty: objalloc.c
Log Message:
pull in upstream rev. 191413 to fix integer overflow in objalloc_alloc
(CVE-2012-3509)
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.1 -r1.2 \
src/external/gpl3/binutils/dist/include/objalloc.h
cvs rdiff -u -r1.1.1.1 -r1.2 \
src/external/gpl3/binutils/dist/libiberty/objalloc.c
cvs rdiff -u -r1.1.1.1 -r1.2 src/external/gpl3/gcc/dist/include/objalloc.h
cvs rdiff -u -r1.1.1.1 -r1.2 src/external/gpl3/gcc/dist/libiberty/objalloc.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/external/gpl3/binutils/dist/include/objalloc.h
diff -u src/external/gpl3/binutils/dist/include/objalloc.h:1.1.1.1 src/external/gpl3/binutils/dist/include/objalloc.h:1.2
--- src/external/gpl3/binutils/dist/include/objalloc.h:1.1.1.1 Tue Aug 18 09:48:54 2009
+++ src/external/gpl3/binutils/dist/include/objalloc.h Thu Oct 25 17:00:16 2012
@@ -1,5 +1,5 @@
/* objalloc.h -- routines to allocate memory for objects
- Copyright 1997, 2001 Free Software Foundation, Inc.
+ Copyright 1997-2012 Free Software Foundation, Inc.
Written by Ian Lance Taylor, Cygnus Solutions.
This program is free software; you can redistribute it and/or modify it
@@ -91,7 +91,7 @@ extern void *_objalloc_alloc (struct obj
if (__len == 0) \
__len = 1; \
__len = (__len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1); \
- (__len <= __o->current_space \
+ (__len != 0 && __len <= __o->current_space \
? (__o->current_ptr += __len, \
__o->current_space -= __len, \
(void *) (__o->current_ptr - __len)) \
Index: src/external/gpl3/binutils/dist/libiberty/objalloc.c
diff -u src/external/gpl3/binutils/dist/libiberty/objalloc.c:1.1.1.1 src/external/gpl3/binutils/dist/libiberty/objalloc.c:1.2
--- src/external/gpl3/binutils/dist/libiberty/objalloc.c:1.1.1.1 Tue Aug 18 09:50:11 2009
+++ src/external/gpl3/binutils/dist/libiberty/objalloc.c Thu Oct 25 17:00:16 2012
@@ -1,5 +1,5 @@
/* objalloc.c -- routines to allocate memory for objects
- Copyright 1997 Free Software Foundation, Inc.
+ Copyright 1997-2012 Free Software Foundation, Inc.
Written by Ian Lance Taylor, Cygnus Solutions.
This program is free software; you can redistribute it and/or modify it
@@ -112,8 +112,10 @@ objalloc_create (void)
/* Allocate space from an objalloc structure. */
PTR
-_objalloc_alloc (struct objalloc *o, unsigned long len)
+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
{
+ unsigned long len = original_len;
+
/* We avoid confusion from zero sized objects by always allocating
at least 1 byte. */
if (len == 0)
@@ -121,6 +123,11 @@ _objalloc_alloc (struct objalloc *o, uns
len = (len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1);
+ /* Check for overflow in the alignment operation above and the
+ malloc argument below. */
+ if (len + CHUNK_HEADER_SIZE < original_len)
+ return NULL;
+
if (len <= o->current_space)
{
o->current_ptr += len;
Index: src/external/gpl3/gcc/dist/include/objalloc.h
diff -u src/external/gpl3/gcc/dist/include/objalloc.h:1.1.1.1 src/external/gpl3/gcc/dist/include/objalloc.h:1.2
--- src/external/gpl3/gcc/dist/include/objalloc.h:1.1.1.1 Tue Jun 21 01:23:10 2011
+++ src/external/gpl3/gcc/dist/include/objalloc.h Thu Oct 25 17:00:16 2012
@@ -1,5 +1,5 @@
/* objalloc.h -- routines to allocate memory for objects
- Copyright 1997, 2001 Free Software Foundation, Inc.
+ Copyright 1997-2012 Free Software Foundation, Inc.
Written by Ian Lance Taylor, Cygnus Solutions.
This program is free software; you can redistribute it and/or modify it
@@ -91,7 +91,7 @@ extern void *_objalloc_alloc (struct obj
if (__len == 0) \
__len = 1; \
__len = (__len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1); \
- (__len <= __o->current_space \
+ (__len != 0 && __len <= __o->current_space \
? (__o->current_ptr += __len, \
__o->current_space -= __len, \
(void *) (__o->current_ptr - __len)) \
Index: src/external/gpl3/gcc/dist/libiberty/objalloc.c
diff -u src/external/gpl3/gcc/dist/libiberty/objalloc.c:1.1.1.1 src/external/gpl3/gcc/dist/libiberty/objalloc.c:1.2
--- src/external/gpl3/gcc/dist/libiberty/objalloc.c:1.1.1.1 Tue Jun 21 01:23:30 2011
+++ src/external/gpl3/gcc/dist/libiberty/objalloc.c Thu Oct 25 17:00:17 2012
@@ -1,5 +1,5 @@
/* objalloc.c -- routines to allocate memory for objects
- Copyright 1997 Free Software Foundation, Inc.
+ Copyright 1997-2012 Free Software Foundation, Inc.
Written by Ian Lance Taylor, Cygnus Solutions.
This program is free software; you can redistribute it and/or modify it
@@ -112,8 +112,10 @@ objalloc_create (void)
/* Allocate space from an objalloc structure. */
PTR
-_objalloc_alloc (struct objalloc *o, unsigned long len)
+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
{
+ unsigned long len = original_len;
+
/* We avoid confusion from zero sized objects by always allocating
at least 1 byte. */
if (len == 0)
@@ -121,6 +123,11 @@ _objalloc_alloc (struct objalloc *o, uns
len = (len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1);
+ /* Check for overflow in the alignment operation above and the
+ malloc argument below. */
+ if (len + CHUNK_HEADER_SIZE < original_len)
+ return NULL;
+
if (len <= o->current_space)
{
o->current_ptr += len;
