1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
# Security update for sunrpc
--- glibc-2.2.5.orig/malloc/malloc.c Wed Sep 19 05:23:27 2001
+++ glibc-2.2.5/malloc/malloc.c Tue Aug 13 11:16:26 2002
@@ -3795,14 +3795,26 @@
{
arena *ar_ptr;
mchunkptr p, oldtop;
- INTERNAL_SIZE_T sz, csz, oldtopsize;
+ INTERNAL_SIZE_T bytes, sz, csz, oldtopsize;
Void_t* mem;
#if defined _LIBC || defined MALLOC_HOOKS
__malloc_ptr_t (*hook) __MALLOC_PMT ((size_t, __const __malloc_ptr_t)) =
__malloc_hook;
+
+ /* size_t is unsigned so the behavior on overflow is defined. */
+ bytes = n * elem_size;
+#define HALF_INTERNAL_SIZE_T \
+ (((INTERNAL_SIZE_T) 1) << (8 * sizeof (INTERNAL_SIZE_T) / 2))
+ if (__builtin_expect ((n | elem_size) >= HALF_INTERNAL_SIZE_T, 0)) {
+ if (elem_size != 0 && bytes / elem_size != n) {
+ __set_errno (ENOMEM);
+ return 0;
+ }
+ }
+
if (hook != NULL) {
- sz = n * elem_size;
+ sz = bytes;
#if defined __GNUC__ && __GNUC__ >= 2
mem = (*hook)(sz, RETURN_ADDRESS (0));
#else
@@ -3819,7 +3831,7 @@
}
#endif
- if(request2size(n * elem_size, sz))
+ if(request2size(bytes, sz))
return 0;
arena_get(ar_ptr, sz);
if(!ar_ptr)
@@ -3862,7 +3874,7 @@
}
if (p == 0) return 0;
}
- mem = BOUNDED_N(chunk2mem(p), n * elem_size);
+ mem = BOUNDED_N(chunk2mem(p), bytes);
/* Two optional cases in which clearing not necessary */
@@ -4899,9 +4911,9 @@
{
void *mem;
- /* Test whether the SIZE argument is valid. It must be a power of
- two multiple of sizeof (void *). */
- if (size % sizeof (void *) != 0 || (size & (size - 1)) != 0)
+ /* Test whether the ALIGNMENT argument is valid. It must be a power
+ of two multiple of sizeof (void *). */
+ if (alignment % sizeof (void *) != 0 || (alignment & (alignment - 1)) != 0)
return EINVAL;
mem = __libc_memalign (alignment, size);
diff -urN glibc-2.2.5.orig/sunrpc/xdr_array.c glibc-2.2.5/sunrpc/xdr_array.c
--- glibc-2.2.5.orig/sunrpc/xdr_array.c Fri Sep 7 13:59:19 2001
+++ glibc-2.2.5/sunrpc/xdr_array.c Thu Aug 1 16:48:38 2002
@@ -45,6 +45,7 @@
#include <rpc/types.h>
#include <rpc/xdr.h>
#include <libintl.h>
+#include <limits.h>
#ifdef USE_IN_LIBIO
# include <wchar.h>
@@ -81,7 +82,9 @@
return FALSE;
}
c = *sizep;
- if ((c > maxsize) && (xdrs->x_op != XDR_FREE))
+
+ /* Make sure that "c * elsize" doesn't overflow */
+ if ((c > maxsize || UINT_MAX/elsize < c) && (xdrs->x_op != XDR_FREE))
{
return FALSE;
}
|
GitWeb