[PATCH] BZ #15754: CVE-2013-4788 (v3)

[Adhemerval Zanella]

On 26-09-2013 12:05, Carlos O'Donell wrote:
> On 09/25/2013 02:46 PM, Adhemerval Zanella wrote:
>> On 23-09-2013 01:49, Carlos O'Donell wrote:
>>> diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>>> index 9da879c..4620f96 100644
>>> --- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
>>> +++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>>> @@ -2,3 +2,13 @@
>>>
>>>  #define STACK_CHK_GUARD \
>>>    ({ uintptr_t x; asm ("ld %0,-28688(13)" : "=r" (x)); x; })
>>> +
>>> +#define POINTER_CHK_GUARD \
>>> +  ({												\
>>> +     uintptr_t x;										\
>>> +     asm ("ld %0,%1(2)"										\
>>> +	  : "=r" (x)										\
>>> +	  : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))	\
>>> +         );											\
>>> +     x;												\
>>> +   })
>> Thanks for the patch Carlos, I pushed this obvious fix:
>>
>> diff --git a/sysdeps/powerpc/powerpc64/stackguard-macros.h b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> index 4620f96..e80a683 100644
>> --- a/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> +++ b/sysdeps/powerpc/powerpc64/stackguard-macros.h
>> @@ -6,7 +6,7 @@
>>  #define POINTER_CHK_GUARD \
>>    ({                                                                                           \
>>       uintptr_t x;                                                                              \
>> -     asm ("ld %0,%1(2)"                                                                                \
>> +     asm ("ld %0,%1(13)"                                                                               \
>>           : "=r" (x)                                                                            \
>>           : "i" (offsetof (tcbhead_t, pointer_guard) - TLS_TCB_OFFSET - sizeof (tcbhead_t))     \
>>           );                                                                                    \
>>
> Sorry, I thought I had already fixed that, but perhaps
> this fix didn't make it into my final merged version of
> the patch. It obviously would have failed in my ppc64
> testing, so I must have failed to merge that fix.
>
> Thanks for fixing this! I assume the test passes now?
>
> Cheers,
> Carlos.
>
Yeah, they do.