[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#681145: unblock: libgc/7.1-9



Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: freeze-exception

Please unblock package libgc

This upload fixes CVE-2012-2673. It is only using the patches approved
upstream to fix this issue (the -malloc.diff one backported to out 7.1
package, rest does work as is).

unblock libgc/7.1-9

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.4-trunk-amd64 (SMP w/6 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -Nru libgc-7.1/debian/changelog libgc-7.1/debian/changelog
--- libgc-7.1/debian/changelog	2011-05-29 18:55:21.000000000 +0200
+++ libgc-7.1/debian/changelog	2012-07-11 00:30:07.000000000 +0200
@@ -1,3 +1,9 @@
+libgc (1:7.1-9) unstable; urgency=medium
+
+  * Import patches to fix CVE-2012-2673 from upstream git (Closes: #677195)
+
+ -- Christoph Egger <christoph@debian.org>  Sun, 08 Jul 2012 18:27:48 +0200
+
 libgc (1:7.1-8) unstable; urgency=low
 
   * Import patch by Thorsten Glaser
diff -Nru libgc-7.1/debian/patches/CVE-2012-2673-calloc-1.diff libgc-7.1/debian/patches/CVE-2012-2673-calloc-1.diff
--- libgc-7.1/debian/patches/CVE-2012-2673-calloc-1.diff	1970-01-01 01:00:00.000000000 +0100
+++ libgc-7.1/debian/patches/CVE-2012-2673-calloc-1.diff	2012-07-11 00:26:57.000000000 +0200
@@ -0,0 +1,29 @@
+From e10c1eb9908c2774c16b3148b30d2f3823d66a9a Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Thu, 15 Mar 2012 04:46:49 +0800
+Subject: [PATCH] Fix calloc() overflow
+
+* malloc.c (calloc): Check multiplication overflow in calloc(),
+assuming REDIRECT_MALLOC.
+---
+ malloc.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+Index: libgc/malloc.c
+===================================================================
+--- libgc.orig/malloc.c	2008-03-10 06:33:41.000000000 +0100
++++ libgc/malloc.c	2012-07-08 18:08:40.030368600 +0200
+@@ -344,8 +344,13 @@
+   }
+ #endif
+ 
++#ifndef SIZE_MAX
++#define SIZE_MAX (~(size_t)0)
++#endif
+ void * calloc(size_t n, size_t lb)
+ {
++    if (lb && n > SIZE_MAX / lb)
++      return NULL;
+ #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
+ 	/* libpthread allocated some memory that is only pointed to by	*/
+ 	/* mmapped thread stacks.  Make sure it's not collectable.	*/
diff -Nru libgc-7.1/debian/patches/CVE-2012-2673-calloc-2.diff libgc-7.1/debian/patches/CVE-2012-2673-calloc-2.diff
--- libgc-7.1/debian/patches/CVE-2012-2673-calloc-2.diff	1970-01-01 01:00:00.000000000 +0100
+++ libgc-7.1/debian/patches/CVE-2012-2673-calloc-2.diff	2012-07-11 00:26:57.000000000 +0200
@@ -0,0 +1,36 @@
+From 6a93f8e5bcad22137f41b6c60a1c7384baaec2b3 Mon Sep 17 00:00:00 2001
+From: Ivan Maidanski <ivmai@mail.ru>
+Date: Thu, 15 Mar 2012 20:30:11 +0400
+Subject: [PATCH] Fix calloc-related code to prevent SIZE_MAX redefinition in
+ sys headers
+
+* malloc.c: Include limits.h for SIZE_MAX.
+* malloc.c (SIZE_MAX, calloc): Define GC_SIZE_MAX instead of SIZE_MAX.
+---
+ malloc.c |   10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+Index: libgc/malloc.c
+===================================================================
+--- libgc.orig/malloc.c	2012-07-08 18:08:40.030368600 +0200
++++ libgc/malloc.c	2012-07-08 18:08:45.420373752 +0200
+@@ -344,12 +344,16 @@
+   }
+ #endif
+ 
+-#ifndef SIZE_MAX
+-#define SIZE_MAX (~(size_t)0)
++#include <limits.h>
++#ifdef SIZE_MAX
++# define GC_SIZE_MAX SIZE_MAX
++#else
++# define GC_SIZE_MAX (~(size_t)0)
+ #endif
++
+ void * calloc(size_t n, size_t lb)
+ {
+-    if (lb && n > SIZE_MAX / lb)
++    if (lb && n > GC_SIZE_MAX / lb)
+       return NULL;
+ #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
+ 	/* libpthread allocated some memory that is only pointed to by	*/
diff -Nru libgc-7.1/debian/patches/CVE-2012-2673-calloc-3.diff libgc-7.1/debian/patches/CVE-2012-2673-calloc-3.diff
--- libgc-7.1/debian/patches/CVE-2012-2673-calloc-3.diff	1970-01-01 01:00:00.000000000 +0100
+++ libgc-7.1/debian/patches/CVE-2012-2673-calloc-3.diff	2012-07-11 00:26:57.000000000 +0200
@@ -0,0 +1,31 @@
+From 83231d0ab5ed60015797c3d1ad9056295ac3b2bb Mon Sep 17 00:00:00 2001
+From: Hans Boehm <Hans.Boehm@hp.com>
+Date: Thu, 15 Mar 2012 21:09:05 +0400
+Subject: [PATCH] Speedup calloc size overflow check by preventing division if
+ small values
+
+* malloc.c (GC_SQRT_SIZE_MAX): New macro.
+* malloc.c (calloc): Add fast initial size overflow check to avoid
+integer division for reasonably small values passed.
+---
+ malloc.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+Index: libgc/malloc.c
+===================================================================
+--- libgc.orig/malloc.c	2012-07-08 17:54:21.530370090 +0200
++++ libgc/malloc.c	2012-07-08 17:54:21.000000000 +0200
+@@ -351,9 +351,12 @@
+ # define GC_SIZE_MAX (~(size_t)0)
+ #endif
+ 
++#define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)
++
+ void * calloc(size_t n, size_t lb)
+ {
+-    if (lb && n > GC_SIZE_MAX / lb)
++    if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial test */
++        && lb && n > GC_SIZE_MAX / lb)
+       return NULL;
+ #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
+ 	/* libpthread allocated some memory that is only pointed to by	*/
diff -Nru libgc-7.1/debian/patches/CVE-2012-2673-malloc.diff libgc-7.1/debian/patches/CVE-2012-2673-malloc.diff
--- libgc-7.1/debian/patches/CVE-2012-2673-malloc.diff	1970-01-01 01:00:00.000000000 +0100
+++ libgc-7.1/debian/patches/CVE-2012-2673-malloc.diff	2012-07-11 00:26:57.000000000 +0200
@@ -0,0 +1,41 @@
+From be9df82919960214ee4b9d3313523bff44fd99e1 Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Thu, 15 Mar 2012 04:55:08 +0800
+Subject: [PATCH] Fix allocation size overflows due to rounding.
+
+* malloc.c (GC_generic_malloc): Check if the allocation size is
+rounded to a smaller value.
+* mallocx.c (GC_generic_malloc_ignore_off_page): Likewise.
+---
+ malloc.c  |    2 ++
+ mallocx.c |    2 ++
+ 2 files changed, 4 insertions(+)
+
+Index: libgc/malloc.c
+===================================================================
+--- libgc.orig/malloc.c	2012-07-08 18:23:03.980370526 +0200
++++ libgc/malloc.c	2012-07-08 18:24:58.640366221 +0200
+@@ -165,6 +165,9 @@
+ 	GC_bool init;
+ 	lw = ROUNDED_UP_WORDS(lb);
+ 	lb_rounded = WORDS_TO_BYTES(lw);
++	if (lb_rounded < lb)
++	  return((*GC_oom_fn)(lb));
++
+ 	n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
+ 	init = GC_obj_kinds[k].ok_init;
+ 	LOCK();
+Index: libgc/mallocx.c
+===================================================================
+--- libgc.orig/mallocx.c	2012-07-08 18:21:54.800368132 +0200
++++ libgc/mallocx.c	2012-07-08 18:25:13.620365430 +0200
+@@ -179,6 +179,9 @@
+         return(GC_generic_malloc((word)lb, k));
+     lw = ROUNDED_UP_WORDS(lb);
+     lb_rounded = WORDS_TO_BYTES(lw);
++    if (lb_rounded < lb)
++	  return((*GC_oom_fn)(lb));
++
+     n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
+     init = GC_obj_kinds[k].ok_init;
+     if (GC_have_errors) GC_print_all_errors();
diff -Nru libgc-7.1/debian/patches/series libgc-7.1/debian/patches/series
--- libgc-7.1/debian/patches/series	2011-05-29 15:19:45.000000000 +0200
+++ libgc-7.1/debian/patches/series	2012-07-11 00:26:57.000000000 +0200
@@ -5,3 +5,7 @@
 #05-s390-includes.diff
 enable-threads.diff
 06-m68k-no-getcontext.diff
+CVE-2012-2673-calloc-1.diff
+CVE-2012-2673-calloc-2.diff
+CVE-2012-2673-calloc-3.diff
+CVE-2012-2673-malloc.diff

Reply to: