diff --git a/SOURCES/glibc-rh1912544.patch b/SOURCES/glibc-rh1912544.patch new file mode 100644 index 0000000..c64e731 --- /dev/null +++ b/SOURCES/glibc-rh1912544.patch @@ -0,0 +1,126 @@ +commit ee7a3144c9922808181009b7b3e50e852fb4999b +Author: Andreas Schwab +Date: Mon Dec 21 08:56:43 2020 +0530 + + Fix buffer overrun in EUC-KR conversion module (bz #24973) + + The byte 0xfe as input to the EUC-KR conversion denotes a user-defined + area and is not allowed. The from_euc_kr function used to skip two bytes + when told to skip over the unknown designation, potentially running over + the buffer end. + +# Conflicts: +# iconvdata/Makefile + +diff --git a/iconvdata/Makefile b/iconvdata/Makefile +index 06e161d9b8f67118..a47a4c07cd2e3d1b 100644 +--- a/iconvdata/Makefile ++++ b/iconvdata/Makefile +@@ -73,7 +73,7 @@ modules.so := $(addsuffix .so, $(modules)) + ifeq (yes,$(build-shared)) + tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ + tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ +- bug-iconv10 bug-iconv11 bug-iconv12 ++ bug-iconv10 bug-iconv11 bug-iconv12 bug-iconv13 + ifeq ($(have-thread-library),yes) + tests += bug-iconv3 + endif +diff --git a/iconvdata/bug-iconv13.c b/iconvdata/bug-iconv13.c +new file mode 100644 +index 0000000000000000..87aaff398e0f6167 +--- /dev/null ++++ b/iconvdata/bug-iconv13.c +@@ -0,0 +1,53 @@ ++/* bug 24973: Test EUC-KR module ++ Copyright (C) 2020 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ iconv_t cd = iconv_open ("UTF-8//IGNORE", "EUC-KR"); ++ TEST_VERIFY_EXIT (cd != (iconv_t) -1); ++ ++ /* 0xfe (->0x7e : row 94) and 0xc9 (->0x49 : row 41) are user-defined ++ areas, which are not allowed and should be skipped over due to ++ //IGNORE. The trailing 0xfe also is an incomplete sequence, which ++ should be checked first. */ ++ char input[4] = { '\xc9', '\xa1', '\0', '\xfe' }; ++ char *inptr = input; ++ size_t insize = sizeof (input); ++ char output[4]; ++ char *outptr = output; ++ size_t outsize = sizeof (output); ++ ++ /* This used to crash due to buffer overrun. */ ++ TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == (size_t) -1); ++ TEST_VERIFY (errno == EINVAL); ++ /* The conversion should produce one character, the converted null ++ character. */ ++ TEST_VERIFY (sizeof (output) - outsize == 1); ++ ++ TEST_VERIFY_EXIT (iconv_close (cd) != -1); ++ ++ return 0; ++} ++ ++#include +diff --git a/iconvdata/euc-kr.c b/iconvdata/euc-kr.c +index 73e02817a07e873d..dc7eaa6596f5d4d4 100644 +--- a/iconvdata/euc-kr.c ++++ b/iconvdata/euc-kr.c +@@ -80,11 +80,7 @@ euckr_from_ucs4 (uint32_t ch, unsigned char *cp) + \ + if (ch <= 0x9f) \ + ++inptr; \ +- /* 0xfe(->0x7e : row 94) and 0xc9(->0x59 : row 41) are \ +- user-defined areas. */ \ +- else if (__builtin_expect (ch == 0xa0, 0) \ +- || __builtin_expect (ch > 0xfe, 0) \ +- || __builtin_expect (ch == 0xc9, 0)) \ ++ else if (__glibc_unlikely (ch == 0xa0)) \ + { \ + /* This is illegal. */ \ + STANDARD_FROM_LOOP_ERR_HANDLER (1); \ +diff --git a/iconvdata/ksc5601.h b/iconvdata/ksc5601.h +index 5588d3a14b667b42..fa2d30677c41f46a 100644 +--- a/iconvdata/ksc5601.h ++++ b/iconvdata/ksc5601.h +@@ -50,15 +50,15 @@ ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset) + unsigned char ch2; + int idx; + ++ if (avail < 2) ++ return 0; ++ + /* row 94(0x7e) and row 41(0x49) are user-defined area in KS C 5601 */ + + if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e + || (ch - offset) == 0x49) + return __UNKNOWN_10646_CHAR; + +- if (avail < 2) +- return 0; +- + ch2 = (*s)[1]; + if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f) + return __UNKNOWN_10646_CHAR; diff --git a/SOURCES/glibc-rh1918115.patch b/SOURCES/glibc-rh1918115.patch new file mode 100644 index 0000000..1556ff4 --- /dev/null +++ b/SOURCES/glibc-rh1918115.patch @@ -0,0 +1,23 @@ +commit 23af890b3f04e80da783ba64e6b6d94822e01d54 +Author: Ondřej Hošek +Date: Wed Aug 26 04:26:50 2020 +0200 + + x86-64: Fix FMA4 detection in ifunc [BZ #26534] + + A typo in commit 107e6a3c2212ba7a3a4ec7cae8d82d73f7c95d0b causes the + FMA4 code path to be taken on systems that support FMA, even if they do + not support FMA4. Fix this to detect FMA4. + +diff --git a/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h b/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h +index 76c677198dac5cb0..6cb70ce25209ee15 100644 +--- a/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h ++++ b/sysdeps/x86_64/fpu/multiarch/ifunc-fma4.h +@@ -32,7 +32,7 @@ IFUNC_SELECTOR (void) + && CPU_FEATURE_USABLE_P (cpu_features, AVX2)) + return OPTIMIZE (fma); + +- if (CPU_FEATURE_USABLE_P (cpu_features, FMA)) ++ if (CPU_FEATURE_USABLE_P (cpu_features, FMA4)) + return OPTIMIZE (fma4); + + return OPTIMIZE (sse2); diff --git a/SPECS/glibc.spec b/SPECS/glibc.spec index 48786c5..24421a5 100644 --- a/SPECS/glibc.spec +++ b/SPECS/glibc.spec @@ -1,6 +1,6 @@ %define glibcsrcdir glibc-2.28 %define glibcversion 2.28 -%define glibcrelease 145%{?dist} +%define glibcrelease 147%{?dist} # Pre-release tarballs are pulled in from git using a command that is # effectively: # @@ -677,6 +677,8 @@ Patch540: glibc-rh1882466-1.patch Patch541: glibc-rh1882466-2.patch Patch542: glibc-rh1882466-3.patch Patch543: glibc-rh1817513-133.patch +Patch544: glibc-rh1912544.patch +Patch545: glibc-rh1918115.patch ############################################################################## # Continued list of core "glibc" package information: @@ -2588,6 +2590,12 @@ fi %files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared %changelog +* Wed Jan 20 2021 Florian Weimer - 2.28-147 +- x86-64: Fix FMA4 math routine selection after bug 1817513 (#1918115) + +* Mon Jan 18 2021 Siddhesh Poyarekar - 2.28-146 +- CVE-2019-25013:Fix buffer overrun in EUC-KR conversion module (#1912544) + * Mon Jan 4 2021 Florian Weimer - 2.28-145 - Update glibc-hwcaps fix from upstream (#1817513)