[Bug string/24097] Can't use 64-bit register for size_t in assembly codes for x32 (CVE-2019-6488)

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=24097

--- Comment #6 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.28/master has been updated
       via  eee0a3d04b8226abd8a6ca077094afbb3559dddb (commit)
      from  781403407b3a432c8fd28cb1f630a63244eb4394 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eee0a3d04b8226abd8a6ca077094afbb3559dddb

commit eee0a3d04b8226abd8a6ca077094afbb3559dddb
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Feb 1 12:20:54 2019 -0800

    x86-64 memrchr: Properly handle the length parameter [BZ #24097]

    On x32, the size_t parameter may be passed in the lower 32 bits of a
    64-bit register with the non-zero upper 32 bits.  The string/memory
    functions written in assembly can only use the lower 32 bits of a
    64-bit register as length or must clear the upper 32 bits before using
    the full 64-bit register for length.

    This pach fixes memrchr for x32.  Tested on x86-64 and x32.  On x86-64,
    libc.so is the same with and withou the fix.

        [BZ #24097]
        CVE-2019-6488
        * sysdeps/x86_64/memrchr.S: Use RDX_LP for length.
        * sysdeps/x86_64/multiarch/memrchr-avx2.S: Likewise.
        * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memrchr.
        * sysdeps/x86_64/x32/tst-size_t-memrchr.c: New file.

    (cherry picked from commit ecd8b842cf37ea112e59cd9085ff1f1b6e208ae0)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |    9 +++++++
 sysdeps/x86_64/memrchr.S                           |    4 +-
 sysdeps/x86_64/multiarch/memrchr-avx2.S            |    4 +-
 sysdeps/x86_64/x32/Makefile                        |    3 +-
 .../{tst-size_t-memcpy.c => tst-size_t-memrchr.c}  |   23 +++++++++----------
 5 files changed, 26 insertions(+), 17 deletions(-)
 copy sysdeps/x86_64/x32/{tst-size_t-memcpy.c => tst-size_t-memrchr.c} (69%)

-- 
You are receiving this mail because:
You are on the CC list for the bug.