aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch')
-rw-r--r--meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch270
1 files changed, 0 insertions, 270 deletions
diff --git a/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch b/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
deleted file mode 100644
index 4a9ed69938..0000000000
--- a/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
+++ /dev/null
@@ -1,270 +0,0 @@
-From 7d235b1b5ea35352c54957ef5530d9a02c46962f Mon Sep 17 00:00:00 2001
-From: bernds <bernds@138bc75d-0d04-0410-961f-82ee72b054a4>
-Date: Mon, 2 May 2016 17:06:40 +0000
-Subject: [PATCH] =?UTF-8?q?Demangler=20integer=20overflow=20fixes=20from?=
- =?UTF-8?q?=20Marcel=20B=C3=B6hme.?=
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
- PR c++/70498
- * cp-demangle.c: Parse numbers as integer instead of long to avoid
- overflow after sanity checks. Include <limits.h> if available.
- (INT_MAX): Define if necessary.
- (d_make_template_param): Takes integer argument instead of long.
- (d_make_function_param): Likewise.
- (d_append_num): Likewise.
- (d_identifier): Likewise.
- (d_number): Parse as and return integer.
- (d_compact_number): Handle overflow.
- (d_source_name): Change variable type to integer for parsed number.
- (d_java_resource): Likewise.
- (d_special_name): Likewise.
- (d_discriminator): Likewise.
- (d_unnamed_type): Likewise.
- * testsuite/demangle-expected: Add regression test cases.
-
-
-
-git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@235767 138bc75d-0d04-0410-961f-82ee72b054a4
-
-Upstream-Status: Backport
-
-CVE: CVE-2016-4490
-hand applied ChangeLog
-
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
----
- libiberty/ChangeLog | 19 +++++++++++++
- libiberty/cp-demangle.c | 52 ++++++++++++++++++++---------------
- libiberty/testsuite/demangle-expected | 14 ++++++++--
- 3 files changed, 61 insertions(+), 24 deletions(-)
-
-Index: gcc-5.3.0/libiberty/cp-demangle.c
-===================================================================
---- gcc-5.3.0.orig/libiberty/cp-demangle.c
-+++ gcc-5.3.0/libiberty/cp-demangle.c
-@@ -124,6 +124,13 @@ extern char *alloca ();
- # endif /* alloca */
- #endif /* HAVE_ALLOCA_H */
-
-+#ifdef HAVE_LIMITS_H
-+#include <limits.h>
-+#endif
-+#ifndef INT_MAX
-+# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
-+#endif
-+
- #include "ansidecl.h"
- #include "libiberty.h"
- #include "demangle.h"
-@@ -394,7 +401,7 @@ d_make_dtor (struct d_info *, enum gnu_v
- struct demangle_component *);
-
- static struct demangle_component *
--d_make_template_param (struct d_info *, long);
-+d_make_template_param (struct d_info *, int);
-
- static struct demangle_component *
- d_make_sub (struct d_info *, const char *, int);
-@@ -417,7 +424,7 @@ static struct demangle_component *d_unqu
-
- static struct demangle_component *d_source_name (struct d_info *);
-
--static long d_number (struct d_info *);
-+static int d_number (struct d_info *);
-
- static struct demangle_component *d_identifier (struct d_info *, int);
-
-@@ -1105,7 +1112,7 @@ d_make_dtor (struct d_info *di, enum gnu
- /* Add a new template parameter. */
-
- static struct demangle_component *
--d_make_template_param (struct d_info *di, long i)
-+d_make_template_param (struct d_info *di, int i)
- {
- struct demangle_component *p;
-
-@@ -1121,7 +1128,7 @@ d_make_template_param (struct d_info *di
- /* Add a new function parameter. */
-
- static struct demangle_component *
--d_make_function_param (struct d_info *di, long i)
-+d_make_function_param (struct d_info *di, int i)
- {
- struct demangle_component *p;
-
-@@ -1595,7 +1602,7 @@ d_unqualified_name (struct d_info *di)
- static struct demangle_component *
- d_source_name (struct d_info *di)
- {
-- long len;
-+ int len;
- struct demangle_component *ret;
-
- len = d_number (di);
-@@ -1608,12 +1615,12 @@ d_source_name (struct d_info *di)
-
- /* number ::= [n] <(non-negative decimal integer)> */
-
--static long
-+static int
- d_number (struct d_info *di)
- {
- int negative;
- char peek;
-- long ret;
-+ int ret;
-
- negative = 0;
- peek = d_peek_char (di);
-@@ -1840,7 +1847,7 @@ d_java_resource (struct d_info *di)
- {
- struct demangle_component *p = NULL;
- struct demangle_component *next = NULL;
-- long len, i;
-+ int len, i;
- char c;
- const char *str;
-
-@@ -1982,7 +1989,7 @@ d_special_name (struct d_info *di)
- case 'C':
- {
- struct demangle_component *derived_type;
-- long offset;
-+ int offset;
- struct demangle_component *base_type;
-
- derived_type = cplus_demangle_type (di);
-@@ -2905,10 +2912,10 @@ d_pointer_to_member_type (struct d_info
-
- /* <non-negative number> _ */
-
--static long
-+static int
- d_compact_number (struct d_info *di)
- {
-- long num;
-+ int num;
- if (d_peek_char (di) == '_')
- num = 0;
- else if (d_peek_char (di) == 'n')
-@@ -2916,7 +2923,7 @@ d_compact_number (struct d_info *di)
- else
- num = d_number (di) + 1;
-
-- if (! d_check_char (di, '_'))
-+ if (num < 0 || ! d_check_char (di, '_'))
- return -1;
- return num;
- }
-@@ -2928,7 +2935,7 @@ d_compact_number (struct d_info *di)
- static struct demangle_component *
- d_template_param (struct d_info *di)
- {
-- long param;
-+ int param;
-
- if (! d_check_char (di, 'T'))
- return NULL;
-@@ -3130,9 +3137,10 @@ d_expression_1 (struct d_info *di)
- }
- else
- {
-- index = d_compact_number (di) + 1;
-- if (index == 0)
-+ index = d_compact_number (di);
-+ if (index == INT_MAX || index == -1)
- return NULL;
-+ index ++;
- }
- return d_make_function_param (di, index);
- }
-@@ -3455,7 +3463,7 @@ d_local_name (struct d_info *di)
- static int
- d_discriminator (struct d_info *di)
- {
-- long discrim;
-+ int discrim;
-
- if (d_peek_char (di) != '_')
- return 1;
-@@ -3511,7 +3519,7 @@ static struct demangle_component *
- d_unnamed_type (struct d_info *di)
- {
- struct demangle_component *ret;
-- long num;
-+ int num;
-
- if (! d_check_char (di, 'U'))
- return NULL;
-@@ -4037,10 +4045,10 @@ d_append_string (struct d_print_info *dp
- }
-
- static inline void
--d_append_num (struct d_print_info *dpi, long l)
-+d_append_num (struct d_print_info *dpi, int l)
- {
- char buf[25];
-- sprintf (buf,"%ld", l);
-+ sprintf (buf,"%d", l);
- d_append_string (dpi, buf);
- }
-
-Index: gcc-5.3.0/libiberty/testsuite/demangle-expected
-===================================================================
---- gcc-5.3.0.orig/libiberty/testsuite/demangle-expected
-+++ gcc-5.3.0/libiberty/testsuite/demangle-expected
-@@ -4357,12 +4357,22 @@ _QueueNotification_QueueController__$4PP
- _Z1fSsB3fooS_
- f(std::string[abi:foo], std::string[abi:foo])
- #
--# Tests a use-after-free problem
-+# Tests a use-after-free problem PR70481
-
- _Q.__0
- ::Q.(void)
- #
--# Tests a use-after-free problem
-+# Tests a use-after-free problem PR70481
-
- _Q10-__9cafebabe.
- cafebabe.::-(void)
-+#
-+# Tests integer overflow problem PR70492
-+
-+__vt_90000000000cafebabe
-+__vt_90000000000cafebabe
-+#
-+# Tests write access violation PR70498
-+
-+_Z80800000000000000000000
-+_Z80800000000000000000000
-Index: gcc-5.3.0/libiberty/ChangeLog
-===================================================================
---- gcc-5.3.0.orig/libiberty/ChangeLog
-+++ gcc-5.3.0/libiberty/ChangeLog
-@@ -1,3 +1,22 @@
-+2016-05-02 Marcel Böhme <boehme.marcel@gmail.com>
-+
-+ PR c++/70498
-+ * cp-demangle.c: Parse numbers as integer instead of long to avoid
-+ overflow after sanity checks. Include <limits.h> if available.
-+ (INT_MAX): Define if necessary.
-+ (d_make_template_param): Takes integer argument instead of long.
-+ (d_make_function_param): Likewise.
-+ (d_append_num): Likewise.
-+ (d_identifier): Likewise.
-+ (d_number): Parse as and return integer.
-+ (d_compact_number): Handle overflow.
-+ (d_source_name): Change variable type to integer for parsed number.
-+ (d_java_resource): Likewise.
-+ (d_special_name): Likewise.
-+ (d_discriminator): Likewise.
-+ (d_unnamed_type): Likewise.
-+ * testsuite/demangle-expected: Add regression test cases.
-+
- 2016-04-08 Marcel Böhme <boehme.marcel@gmail.com>
-
- PR c++/69687
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-25 11:01:01 +0000