wok-current view aspell/stuff/patches/CVE-2019-25051 @ rev 24362
aspell: apply patch CVE-2019-25051
| author | Hans-G?nter Theisgen |
|---|---|
| date | Fri Feb 04 15:05:05 2022 +0100 (2022-02-04) |
| parents | |
| children |
line source
1 From 0718b375425aad8e54e1150313b862e4c6fd324a Mon Sep 17 00:00:00 2001
2 From: Kevin Atkinson <kevina@gnu.org>
3 Date: Sat, 21 Dec 2019 20:32:47 +0000
4 Subject: [PATCH] objstack: assert that the alloc size will fit within a chunk
5 to prevent a buffer overflow
7 Bug found using OSS-Fuze.
8 ---
9 common/objstack.hpp | 18 ++++++++++++++----
10 1 file changed, 14 insertions(+), 4 deletions(-)
12 diff --git a/common/objstack.hpp b/common/objstack.hpp
13 index 3997bf7..bd97ccd 100644
14 --- a/common/objstack.hpp
15 +++ b/common/objstack.hpp
16 @@ -5,6 +5,7 @@
17 #include "parm_string.hpp"
18 #include <stdlib.h>
19 #include <assert.h>
20 +#include <stddef.h>
22 namespace acommon {
24 @@ -26,6 +27,12 @@ class ObjStack
25 byte * temp_end;
26 void setup_chunk();
27 void new_chunk();
28 + bool will_overflow(size_t sz) const {
29 + return offsetof(Node,data) + sz > chunk_size;
30 + }
31 + void check_size(size_t sz) {
32 + assert(!will_overflow(sz));
33 + }
35 ObjStack(const ObjStack &);
36 void operator=(const ObjStack &);
37 @@ -56,7 +63,7 @@ class ObjStack
38 void * alloc_bottom(size_t size) {
39 byte * tmp = bottom;
40 bottom += size;
41 - if (bottom > top) {new_chunk(); tmp = bottom; bottom += size;}
42 + if (bottom > top) {check_size(size); new_chunk(); tmp = bottom; bottom += size;}
43 return tmp;
44 }
45 // This alloc_bottom will insure that the object is aligned based on the
46 @@ -66,7 +73,7 @@ class ObjStack
47 align_bottom(align);
48 byte * tmp = bottom;
49 bottom += size;
50 - if (bottom > top) {new_chunk(); goto loop;}
51 + if (bottom > top) {check_size(size); new_chunk(); goto loop;}
52 return tmp;
53 }
54 char * dup_bottom(ParmString str) {
55 @@ -79,7 +86,7 @@ class ObjStack
56 // always be aligned as such.
57 void * alloc_top(size_t size) {
58 top -= size;
59 - if (top < bottom) {new_chunk(); top -= size;}
60 + if (top < bottom) {check_size(size); new_chunk(); top -= size;}
61 return top;
62 }
63 // This alloc_top will insure that the object is aligned based on
64 @@ -88,7 +95,7 @@ class ObjStack
65 {loop:
66 top -= size;
67 align_top(align);
68 - if (top < bottom) {new_chunk(); goto loop;}
69 + if (top < bottom) {check_size(size); new_chunk(); goto loop;}
70 return top;
71 }
72 char * dup_top(ParmString str) {
73 @@ -117,6 +124,7 @@ class ObjStack
74 void * alloc_temp(size_t size) {
75 temp_end = bottom + size;
76 if (temp_end > top) {
77 + check_size(size);
78 new_chunk();
79 temp_end = bottom + size;
80 }
81 @@ -131,6 +139,7 @@ class ObjStack
82 } else {
83 size_t s = temp_end - bottom;
84 byte * p = bottom;
85 + check_size(size);
86 new_chunk();
87 memcpy(bottom, p, s);
88 temp_end = bottom + size;
89 @@ -150,6 +159,7 @@ class ObjStack
90 } else {
91 size_t s = temp_end - bottom;
92 byte * p = bottom;
93 + check_size(size);
94 new_chunk();
95 memcpy(bottom, p, s);
96 temp_end = bottom + size;