diff options
| author | H.J. Lu <hjl.tools@gmail.com> | 2019-02-04 06:31:01 -0800 |
|---|---|---|
| committer | H.J. Lu <hjl.tools@gmail.com> | 2019-02-04 06:31:13 -0800 |
| commit | 3f635fb43389b54f682fc9ed2acc0b2aaf4a923d (patch) | |
| tree | b157161b8ab3dd20e7304706c6cf8ecd6a91164b /NEWS | |
| parent | 2ab5741b8a96d02eb89e455b1971a19e7aef67bc (diff) | |
| download | glibc-3f635fb43389b54f682fc9ed2acc0b2aaf4a923d.tar glibc-3f635fb43389b54f682fc9ed2acc0b2aaf4a923d.tar.gz glibc-3f635fb43389b54f682fc9ed2acc0b2aaf4a923d.tar.bz2 glibc-3f635fb43389b54f682fc9ed2acc0b2aaf4a923d.zip | |
x86-64 memcmp: Use unsigned Jcc instructions on size [BZ #24155]
Since the size argument is unsigned. we should use unsigned Jcc
instructions, instead of signed, to check size.
Tested on x86-64 and x32, with and without --disable-multi-arch.
[BZ #24155]
CVE-2019-7309
* NEWS: Updated for CVE-2019-7309.
* sysdeps/x86_64/memcmp.S: Use RDX_LP for size. Clear the
upper 32 bits of RDX register for x32. Use unsigned Jcc
instructions, instead of signed.
* sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp-2.
* sysdeps/x86_64/x32/tst-size_t-memcmp-2.c: New test.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 8 |
1 files changed, 7 insertions, 1 deletions
@@ -25,7 +25,13 @@ Changes to build and runtime requirements: Security related changes: - [Add security related changes here] + CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check + size. For x86-64, memcmp on an object size larger than SSIZE_MAX + has undefined behavior. On x32, the size_t argument may be passed + in the lower 32 bits of the 64-bit RDX register with non-zero upper + 32 bits. When it happened with the sign bit of RDX register set, + memcmp gave the wrong result since it treated the size argument as + zero. Reported by H.J. Lu. The following bugs are resolved with this release: |