gnu/packages/patches/glibc-CVE-2018-11237.patch

   1 https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e
   2 with the ChangeLog removed
   3
   4 From 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e Mon Sep 17 00:00:00 2001
   5 From: Andreas Schwab <schwab@suse.de>
   6 Date: Tue, 22 May 2018 10:37:59 +0200
   7 Subject: [PATCH] Don't write beyond destination in
   8  __mempcpy_avx512_no_vzeroupper (bug 23196)
   9
  10 When compiled as mempcpy, the return value is the end of the destination
  11 buffer, thus it cannot be used to refer to the start of it.
  12 ---
  13  ChangeLog                                               | 9 +++++++++
  14  string/test-mempcpy.c                                   | 1 +
  15  sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++--
  16  3 files changed, 13 insertions(+), 2 deletions(-)
  17
  18 diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c
  19 index c08fba8..d98ecdd 100644
  20 --- a/string/test-mempcpy.c
  21 +++ b/string/test-mempcpy.c
  22 @@ -18,6 +18,7 @@
  23     <http://www.gnu.org/licenses/>.  */
  24
  25  #define MEMCPY_RESULT(dst, len) (dst) + (len)
  26 +#define MIN_PAGE_SIZE 131072
  27  #define TEST_MAIN
  28  #define TEST_NAME "mempcpy"
  29  #include "test-string.h"
  30 diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
  31 index 23c0f7a..effc3ac 100644
  32 --- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
  33 +++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
  34 @@ -336,6 +336,7 @@ L(preloop_large):
  35         vmovups (%rsi), %zmm4
  36         vmovups 0x40(%rsi), %zmm5
  37
  38 +       mov     %rdi, %r11
  39  /* Align destination for access with non-temporal stores in the loop.  */
  40         mov     %rdi, %r8
  41         and     $-0x80, %rdi
  42 @@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop):
  43         cmp     $256, %rdx
  44         ja      L(gobble_256bytes_nt_loop)
  45         sfence
  46 -       vmovups %zmm4, (%rax)
  47 -       vmovups %zmm5, 0x40(%rax)
  48 +       vmovups %zmm4, (%r11)
  49 +       vmovups %zmm5, 0x40(%r11)
  50         jmp     L(check)
  51
  52  L(preloop_large_bkw):
  53 --
  54 2.9.3
  55