|
 |
00db10 |
Short description: CVE-2015-5220: calloc() returns non-zeroed memory.
|
|
|
00db10 |
Author(s): Ondrej Bilka
|
|
|
00db10 |
Origin: git://sourceware.org/git/glibc.git
|
|
|
00db10 |
Bug-RHEL: #1296453 (rhel-7.2.z), #1293976 (rhel-7.3), #1256285 (SRT)
|
|
|
00db10 |
Bug-Fedora: NA
|
|
|
00db10 |
Bug-Upstream: NA
|
|
|
00db10 |
Upstream status: committed
|
|
|
00db10 |
#
|
|
|
00db10 |
# commit e8349efd466cfedc0aa98be61d88ca8795c9e565
|
|
|
00db10 |
# Author: Ondřej Bílka <neleai@seznam.cz>
|
|
|
00db10 |
# Date: Mon Dec 9 17:25:19 2013 +0100
|
|
|
00db10 |
#
|
|
|
00db10 |
# Simplify perturb_byte logic.
|
|
|
00db10 |
#
|
|
|
00db10 |
diff --git a/malloc/malloc.c b/malloc/malloc.c
|
|
|
00db10 |
index 4821deb..ac8c3f6 100644
|
|
|
00db10 |
--- a/malloc/malloc.c
|
|
|
00db10 |
+++ b/malloc/malloc.c
|
|
|
00db10 |
@@ -1870,8 +1870,20 @@ static int check_action = DEFAULT_CHECK_ACTION;
|
|
|
00db10 |
|
|
|
00db10 |
static int perturb_byte;
|
|
|
00db10 |
|
|
|
00db10 |
-#define alloc_perturb(p, n) memset (p, (perturb_byte ^ 0xff) & 0xff, n)
|
|
|
00db10 |
-#define free_perturb(p, n) memset (p, perturb_byte & 0xff, n)
|
|
|
00db10 |
+static inline void
|
|
|
00db10 |
+alloc_perturb (char *p, size_t n)
|
|
|
00db10 |
+{
|
|
|
00db10 |
+ if (__glibc_unlikely (perturb_byte))
|
|
|
00db10 |
+ memset (p, perturb_byte ^ 0xff, n);
|
|
|
00db10 |
+}
|
|
|
00db10 |
+
|
|
|
00db10 |
+static inline void
|
|
|
00db10 |
+free_perturb (char *p, size_t n)
|
|
|
00db10 |
+{
|
|
|
00db10 |
+ if (__glibc_unlikely (perturb_byte))
|
|
|
00db10 |
+ memset (p, perturb_byte, n);
|
|
|
00db10 |
+}
|
|
|
00db10 |
+
|
|
|
00db10 |
|
|
|
00db10 |
|
|
|
00db10 |
#include <stap-probe.h>
|
|
|
00db10 |
@@ -3287,8 +3299,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
}
|
|
|
00db10 |
check_remalloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
}
|
|
|
00db10 |
@@ -3323,8 +3334,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
victim->size |= NON_MAIN_ARENA;
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
}
|
|
|
00db10 |
@@ -3403,8 +3413,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
|
|
|
00db10 |
@@ -3420,8 +3429,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
victim->size |= NON_MAIN_ARENA;
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
|
|
|
00db10 |
@@ -3545,8 +3553,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
}
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
}
|
|
|
00db10 |
@@ -3649,8 +3656,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
}
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
}
|
|
|
00db10 |
@@ -3684,8 +3690,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
|
|
|
00db10 |
check_malloced_chunk(av, victim, nb);
|
|
|
00db10 |
void *p = chunk2mem(victim);
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- alloc_perturb (p, bytes);
|
|
|
00db10 |
+ alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
|
|
|
00db10 |
@@ -3705,7 +3710,7 @@ _int_malloc(mstate av, size_t bytes)
|
|
|
00db10 |
*/
|
|
|
00db10 |
else {
|
|
|
00db10 |
void *p = sysmalloc(nb, av);
|
|
|
00db10 |
- if (p != NULL && __builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
+ if (p != NULL)
|
|
|
00db10 |
alloc_perturb (p, bytes);
|
|
|
00db10 |
return p;
|
|
|
00db10 |
}
|
|
|
00db10 |
@@ -3798,8 +3803,7 @@ _int_free(mstate av, mchunkptr p, int have_lock)
|
|
|
00db10 |
}
|
|
|
00db10 |
}
|
|
|
00db10 |
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
|
|
|
00db10 |
+ free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
|
|
|
00db10 |
|
|
|
00db10 |
set_fastchunks(av);
|
|
|
00db10 |
unsigned int idx = fastbin_index(size);
|
|
|
00db10 |
@@ -3881,8 +3885,7 @@ _int_free(mstate av, mchunkptr p, int have_lock)
|
|
|
00db10 |
goto errout;
|
|
|
00db10 |
}
|
|
|
00db10 |
|
|
|
00db10 |
- if (__builtin_expect (perturb_byte, 0))
|
|
|
00db10 |
- free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
|
|
|
00db10 |
+ free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
|
|
|
00db10 |
|
|
|
00db10 |
/* consolidate backward */
|
|
|
00db10 |
if (!prev_inuse(p)) {
|