mirror of
https://git.yoctoproject.org/poky
synced 2026-05-31 12:49:46 +00:00
Armin Kuster
5a1ac4ea59
(From OE-Core rev: de673641ec75b20a73eda81f3e7e8a8259993a14) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
74 lines
2.2 KiB
Diff
74 lines
2.2 KiB
Diff
From be3004dc350a820a5b0320b34bd05673ba534058 Mon Sep 17 00:00:00 2001
|
|
From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4>
|
|
Date: Thu, 31 Mar 2016 17:20:53 +0000
|
|
Subject: [PATCH] * cplus-dem.c (squangle_mop_up): Zero bsize/ksize
|
|
after freeing btypevec/ktypevec. * testsuite/demangle-expected: Add
|
|
coverage tests.
|
|
|
|
git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@234645 138bc75d-0d04-0410-961f-82ee72b054a4
|
|
|
|
Upstream-Status: Backport
|
|
CVE: CVE-2016-4488
|
|
|
|
patched ChangeLog and demangle-expected as patch is from tip.
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
|
|
---
|
|
libiberty/ChangeLog | 7 +++++++
|
|
libiberty/cplus-dem.c | 2 ++
|
|
libiberty/testsuite/demangle-expected | 10 ++++++++++
|
|
3 files changed, 19 insertions(+)
|
|
|
|
Index: gcc-5.3.0/libiberty/cplus-dem.c
|
|
===================================================================
|
|
--- gcc-5.3.0.orig/libiberty/cplus-dem.c
|
|
+++ gcc-5.3.0/libiberty/cplus-dem.c
|
|
@@ -1237,11 +1237,13 @@ squangle_mop_up (struct work_stuff *work
|
|
{
|
|
free ((char *) work -> btypevec);
|
|
work->btypevec = NULL;
|
|
+ work->bsize = 0;
|
|
}
|
|
if (work -> ktypevec != NULL)
|
|
{
|
|
free ((char *) work -> ktypevec);
|
|
work->ktypevec = NULL;
|
|
+ work->ksize = 0;
|
|
}
|
|
}
|
|
|
|
Index: gcc-5.3.0/libiberty/testsuite/demangle-expected
|
|
===================================================================
|
|
--- gcc-5.3.0.orig/libiberty/testsuite/demangle-expected
|
|
+++ gcc-5.3.0/libiberty/testsuite/demangle-expected
|
|
@@ -4356,3 +4356,13 @@ _QueueNotification_QueueController__$4PP
|
|
--format=gnu-v3
|
|
_Z1fSsB3fooS_
|
|
f(std::string[abi:foo], std::string[abi:foo])
|
|
+#
|
|
+# Tests a use-after-free problem
|
|
+
|
|
+_Q.__0
|
|
+::Q.(void)
|
|
+#
|
|
+# Tests a use-after-free problem
|
|
+
|
|
+_Q10-__9cafebabe.
|
|
+cafebabe.::-(void)
|
|
Index: gcc-5.3.0/libiberty/ChangeLog
|
|
===================================================================
|
|
--- gcc-5.3.0.orig/libiberty/ChangeLog
|
|
+++ gcc-5.3.0/libiberty/ChangeLog
|
|
@@ -1,3 +1,10 @@
|
|
+2016-03-31 Mikhail Maltsev <maltsevm@gmail.com>
|
|
+ Marcel Bohme boehme.marcel@gmail.com
|
|
+
|
|
+ * cplus-dem.c (squangle_mop_up): Zero bsize/ksize after freeing
|
|
+ btypevec/ktypevec.
|
|
+ * testsuite/demangle-expected: Add coverage tests.
|
|
+
|
|
2015-12-04 Release Manager
|
|
|
|
* GCC 5.3.0 released.
|