[PATCH] BZ #15754: CVE-2013-4788 (v3)

[Adhemerval Zanella]

On 23-09-2013 01:49, Carlos O'Donell wrote:
> diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
> index 9da879c..4620f96 100644
> --- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
> +++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
> @@ -2,3 +2,13 @@
>
>  #define STACK_CHK_GUARD \
>    ({ uintptr_t x; asm ("ld %0,-28688(13)" : "=r" (x)); x; })
> +
> +#define POINTER_CHK_GUARD \
> +  ({												\
> +     uintptr_t x;										\
> +     asm ("ld %0,%1(2)"										\
> +	  : "=r" (x)										\
> +	  : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))	\
> +         );											\
> +     x;												\
> +   })

Thanks for the patch Carlos, I pushed this obvious fix:

diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
index 4620f96..e80a683 100644
--- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
+++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
@@ -6,7 +6,7 @@
 #define POINTER_CHK_GUARD \
   ({                                                                                           \
      uintptr_t x;                                                                              \
-     asm ("ld %0,%1(2)"                                                                                \
+     asm ("ld %0,%1(13)"                                                                               \
          : "=r" (x)                                                                            \
          : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))     \
          );                                                                                    \