[PATCH] BZ #15754: CVE-2013-4788 (v3)

[Carlos O'Donell]

On 09/25/2013 02:46 PM, Adhemerval Zanella wrote:
> On 23-09-2013 01:49, Carlos O'Donell wrote:
>> diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> index 9da879c..4620f96 100644
>> --- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> +++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> @@ -2,3 +2,13 @@
>>
>>  #define STACK_CHK_GUARD \
>>    ({ uintptr_t x; asm ("ld %0,-28688(13)" : "=r" (x)); x; })
>> +
>> +#define POINTER_CHK_GUARD \
>> +  ({												\
>> +     uintptr_t x;										\
>> +     asm ("ld %0,%1(2)"										\
>> +	  : "=r" (x)										\
>> +	  : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))	\
>> +         );											\
>> +     x;												\
>> +   })
> 
> Thanks for the patch Carlos, I pushed this obvious fix:
> 
> diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
> index 4620f96..e80a683 100644
> --- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
> +++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
> @@ -6,7 +6,7 @@
>  #define POINTER_CHK_GUARD \
>    ({                                                                                           \
>       uintptr_t x;                                                                              \
> -     asm ("ld %0,%1(2)"                                                                                \
> +     asm ("ld %0,%1(13)"                                                                               \
>           : "=r" (x)                                                                            \
>           : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))     \
>           );                                                                                    \
> 

Sorry, I thought I had already fixed that, but perhaps
this fix didn't make it into my final merged version of
the patch. It obviously would have failed in my ppc64
testing, so I must have failed to merge that fix.

Thanks for fixing this! I assume the test passes now?

Cheers,
Carlos.