From 60c6ffd4a1b8040daf60ab2650c5b3eb46175439 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= ppisar@redhat.com Date: Fri, 20 Jan 2017 09:49:49 +0100 Subject: Fix a heap overflow with pack "W"
--- ...-avoid-a-heap-buffer-overflow-with-pack-W.patch | 58 ++++++++++++++++++++++ ...-fix-the-test-so-skip-has-a-SKIP-to-work-.patch | 30 +++++++++++ perl.spec | 8 +++ 3 files changed, 96 insertions(+) create mode 100644 perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch create mode 100644 perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
diff --git a/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch b/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch new file mode 100644 index 0000000..32bbc4b --- /dev/null +++ b/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch @@ -0,0 +1,58 @@ +From bf4a926a29374161655548b149d1cb37300bcc05 Mon Sep 17 00:00:00 2001 +From: Tony Cook tony@develop-help.com +Date: Wed, 7 Sep 2016 16:51:39 +1000 +Subject: [PATCH] (perl #129149) avoid a heap buffer overflow with pack "W"... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Petr Písař ppisar@redhat.com +--- + pp_pack.c | 2 +- + t/op/pack.t | 13 ++++++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/pp_pack.c b/pp_pack.c +index ee4c69e..737e019 100644 +--- a/pp_pack.c ++++ b/pp_pack.c +@@ -2587,7 +2587,7 @@ S_pack_rec(pTHX_ SV *cat, tempsym_t* symptr, SV **beglist, SV **endlist ) + if (in_bytes) auv = auv % 0x100; + if (utf8) { + W_utf8: +- if (cur > end) { ++ if (cur >= end) { + *cur = '\0'; + SvCUR_set(cat, cur - start); + +diff --git a/t/op/pack.t b/t/op/pack.t +index 3fc12e4..47d1216 100644 +--- a/t/op/pack.t ++++ b/t/op/pack.t +@@ -12,7 +12,7 @@ my $no_endianness = $] > 5.009 ? '' : + my $no_signedness = $] > 5.009 ? '' : + "Signed/unsigned pack modifiers not available on this perl"; + +-plan tests => 14712; ++plan tests => 14713; + + use strict; + use warnings qw(FATAL all); +@@ -2047,3 +2047,14 @@ ok(1, "argument underflow did not crash"); + is(pack("H40", $up_nul), $twenty_nuls, + "check pack H zero fills (utf8 source)"); + } ++ ++{ ++ # [perl #129149] the code below would write one past the end of the output ++ # buffer, only detected by ASAN, not by valgrind ++ $Config{ivsize} >= 8 ++ or skip "[perl #129149] need 64-bit for this test", 1; ++ fresh_perl_is(<<'EOS', "ok\n", { stderr => 1 }, "pack W overflow"); ++print pack("ucW", "0000", 0, 140737488355327) eq "$,#`P,```\n\0\x{7fffffffffff}" ++ ? "ok\n" : "not ok\n"; ++EOS ++} +-- +2.7.4 + diff --git a/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch b/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch new file mode 100644 index 0000000..530b65d --- /dev/null +++ b/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch @@ -0,0 +1,30 @@ +From 30be69c851a7fa7e29d85c9b6e070273df82f3e7 Mon Sep 17 00:00:00 2001 +From: Tony Cook tony@develop-help.com +Date: Tue, 17 Jan 2017 15:36:31 +1100 +Subject: [PATCH] (perl #129149) fix the test so skip has a SKIP: to work with +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Thanks to bulk88 for pointing this out. + +Signed-off-by: Petr Písař ppisar@redhat.com +--- + t/op/pack.t | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/t/op/pack.t b/t/op/pack.t +index 47d1216..919e4c5 100644 +--- a/t/op/pack.t ++++ b/t/op/pack.t +@@ -2048,6 +2048,7 @@ ok(1, "argument underflow did not crash"); + "check pack H zero fills (utf8 source)"); + } + ++SKIP: + { + # [perl #129149] the code below would write one past the end of the output + # buffer, only detected by ASAN, not by valgrind +-- +2.7.4 + diff --git a/perl.spec b/perl.spec index eb898d0..16d81e9 100644 --- a/perl.spec +++ b/perl.spec @@ -159,6 +159,10 @@ Patch53: perl-5.22.2-perl-130307-Correctly-unwind-on-cache-hit.patch # in upstream after 5.25.8 Patch54: perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch
+# Fix a heap overflow with pack "W", RT129149, in upstream after 5.25.8 +Patch55: perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch +Patch56: perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2455,6 +2459,8 @@ Perl extension for Version Objects %patch52 -p1 %patch53 -p1 %patch54 -p1 +%patch55 -p1 +%patch56 -p1 %patch200 -p1 %patch201 -p1
@@ -2498,6 +2504,7 @@ perl -x patchlevel.h \ 'Fedora Patch52: Fix a memory leak in IO::Poll (RT#129788)' \ 'Fedora Patch53: Fix regular expression matching (RT#130307)' \ 'Fedora Patch54: Fix a buffer overflow in split in scalar context (RT#130262)' \ + 'Fedora Patch55: Fix a heap overflow with pack "W" (RT129149)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -4752,6 +4759,7 @@ popd %changelog * Fri Jan 20 2017 Petr Pisar ppisar@redhat.com - 4:5.22.3-367 - Fix a buffer overflow in split in scalar context (RT#130262) +- Fix a heap overflow with pack "W" (RT129149)
* Mon Jan 16 2017 Jitka Plesnikova jplesnik@redhat.com - 4:5.22.3-366 - 5.22.3 bump (see http://search.cpan.org/dist/perl-5.22.3/pod/perldelta.pod