Fix integer overflow in sysdeps/unix/sysv/linux/bits/sched.h

	[BZ #15448]
	* sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S)
	(__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow.

diff --git a/ChangeLog b/ChangeLog
index a7e4b253d110df76f441b6087bf0a6d7899b9941..4226597f7b820f114c4b776aa20f34193d9afb01 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2013-05-10  Andreas Jaeger  <aj@suse.de>
+
+       [BZ #15448]
+       * sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S)
+       (__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow.
+
 2013-05-10  Joseph Myers  <joseph@codesourcery.com>
 
        * math/gen-libm-test.pl (adjust_arg): New function.

diff --git a/NEWS b/NEWS
index 87d9128700610389d68c0626423233b951a8a195..5c005bc2bf578aca61744d39e9f02b0761824cc7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,7 +16,8 @@ Version 2.18
   15055, 15062, 15078, 15084, 15085, 15086, 15160, 15214, 15221, 15232,
   15234, 15283, 15285, 15287, 15304, 15305, 15307, 15309, 15327, 15330,
   15335, 15336, 15337, 15342, 15346, 15359, 15361, 15366, 15380, 15394,
-  15395, 15405, 15406, 15409, 15416, 15418, 15419, 15423, 15426, 15429.
+  15395, 15405, 15406, 15409, 15416, 15418, 15419, 15423, 15426, 15429,
+  15448.
 
 * CVE-2013-0242 Buffer overrun in regexp matcher has been fixed (Bugzilla
   #15078).

diff --git a/sysdeps/unix/sysv/linux/bits/sched.h b/sysdeps/unix/sysv/linux/bits/sched.h
index 5e8057b62e43fc348850122c69d65237157448be..e42dee8e621113293d707b85545427fa06e56ce1 100644 (file)
--- a/sysdeps/unix/sysv/linux/bits/sched.h
+++ b/sysdeps/unix/sysv/linux/bits/sched.h
@@ -144,21 +144,21 @@ typedef struct
 # define __CPU_SET_S(cpu, setsize, cpusetp) \
   (__extension__                                                             \
    ({ size_t __cpu = (cpu);                                                  \
-      __cpu < 8 * (setsize)                                                  \
+      __cpu / 8 < (setsize)                                                  \
       ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]                      \
         |= __CPUMASK (__cpu))                                                \
       : 0; }))
 # define __CPU_CLR_S(cpu, setsize, cpusetp) \
   (__extension__                                                             \
    ({ size_t __cpu = (cpu);                                                  \
-      __cpu < 8 * (setsize)                                                  \
+      __cpu / 8 < (setsize)                                                  \
       ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]                      \
         &= ~__CPUMASK (__cpu))                                               \
       : 0; }))
 # define __CPU_ISSET_S(cpu, setsize, cpusetp) \
   (__extension__                                                             \
    ({ size_t __cpu = (cpu);                                                  \
-      __cpu < 8 * (setsize)                                                  \
+      __cpu / 8 < (setsize)                                                  \
       ? ((((const __cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]       \
          & __CPUMASK (__cpu))) != 0                                          \
       : 0; }))