Commit c07f44bf authored by Natanael Copa's avatar Natanael Copa

main/musl: security fix in i386 math asm (CVE-2019-14697)

fixes #10709
parent dc618a2b
......@@ -2,7 +2,7 @@
# Maintainer: Timo Teräs <timo.teras@iki.fi>
pkgname=musl
pkgver=1.1.18
pkgrel=3
pkgrel=4
pkgdesc="the musl c library (libc) implementation"
url="http://www.musl-libc.org/"
arch="all"
......@@ -17,6 +17,7 @@ nolibc) ;;
*) subpackages="$subpackages $pkgname-utils";;
esac
source="http://www.musl-libc.org/releases/musl-$pkgver.tar.gz
CVE-2019-14697.patch
0001-fix-sysconf-for-infinite-rlimits.patch
0001-use-the-name-UTC-instead-of-GMT-for-UTC-timezone.patch
1000-implement-strftime-GNU-extension-padding-specifiers-.patch
......@@ -31,6 +32,8 @@ source="http://www.musl-libc.org/releases/musl-$pkgver.tar.gz
"
# secfixes:
# 1.1.18-r4:
# - CVE-2019-14697
# 1.1.15-r4:
# - CVE-2016-8859
......@@ -145,6 +148,7 @@ compat() {
}
sha512sums="4d55c92efe41dfdd9fff6aca5dda76a632a3be60d10e5a7f66a4731d8f7040fb0a20b998965ba4d069b4f8a3527fcd7388e646cb66afc649c4d0cc6c3d358c9c musl-1.1.18.tar.gz
37ab61c96b940848e4114de105d87754c7039f52eb2fc19d8bf59c27f484bffbac8b4740e9478207eae03bd7416f7036e04197d0efe30ee5293b17d6d5c1cc15 CVE-2019-14697.patch
7b44cc006d37672a67bc261de33e64d11f6426fd1ab3ff80f9f980aefc8e0b099ab61f95d110eeb59f75c2fe772fe13bc5546c194c3f90ca9ec4c812dfff6b1b 0001-fix-sysconf-for-infinite-rlimits.patch
c28abac671f531d200bd1ebc934fc57b1c04404e49237dd6cfde4fe72e4fd8b855df0e75f76d62ec930c56daa00a12a6a3b3bb1c86576c7504fdf9628ad58975 0001-use-the-name-UTC-instead-of-GMT-for-UTC-timezone.patch
7e4c703e57a3564cd3ee1d5334b806cbe654355179ba55d4d25361dfc555eb4a7d081d80d64fdaff8476949afd04558d278b124d1fb108080beaa5ba2f8ce2b9 1000-implement-strftime-GNU-extension-padding-specifiers-.patch
......
From f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441 Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Mon, 5 Aug 2019 18:41:47 -0400
Subject: fix x87 stack imbalance in corner cases of i386 math asm
commit 31c5fb80b9eae86f801be4f46025bc6532a554c5 introduced underflow
code paths for the i386 math asm, along with checks on the fpu status
word to skip the underflow-generation instructions if the underflow
flag was already raised. unfortunately, at least one such path, in
log1p, returned with 2 items on the x87 stack rather than just 1 item
for the return value. this is a violation of the ABI's calling
convention, and could cause subsequent floating point code to produce
NANs due to x87 stack overflow. if floating point results are used in
flow control, this can lead to runaway wrong code execution.
rather than reviewing each "underflow already raised" code path for
correctness, remove them all. they're likely slower than just
performing the underflow code unconditionally, and significantly more
complex.
all of this code should be ripped out and replaced by C source files
with inline asm. doing so would preclude this kind of error by having
the compiler perform all x87 stack register allocation and stack
manipulation, and would produce comparable or better code. however
such a change is a much larger project.
---
src/math/i386/asin.s | 10 ++--------
src/math/i386/atan.s | 7 ++-----
src/math/i386/atan2.s | 5 +----
src/math/i386/atan2f.s | 5 +----
src/math/i386/atanf.s | 7 ++-----
src/math/i386/exp.s | 10 ++--------
src/math/i386/log1p.s | 7 ++-----
src/math/i386/log1pf.s | 7 ++-----
8 files changed, 14 insertions(+), 44 deletions(-)
diff --git a/src/math/i386/asin.s b/src/math/i386/asin.s
index a9f691bf..920d967a 100644
--- a/src/math/i386/asin.s
+++ b/src/math/i386/asin.s
@@ -7,13 +7,10 @@ asinf:
cmp $0x01000000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 2f
fld %st(0)
fmul %st(1)
fstps 4(%esp)
-2: ret
+ ret
.global asinl
.type asinl,@function
@@ -30,11 +27,8 @@ asin:
cmp $0x00200000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 2f
fsts 4(%esp)
-2: ret
+ ret
1: fld %st(0)
fld1
fsub %st(0),%st(1)
diff --git a/src/math/i386/atan.s b/src/math/i386/atan.s
index d73137b2..a26feae1 100644
--- a/src/math/i386/atan.s
+++ b/src/math/i386/atan.s
@@ -10,8 +10,5 @@ atan:
fpatan
ret
# subnormal x, return x with underflow
-1: fnstsw %ax
- and $16,%ax
- jnz 2f
- fsts 4(%esp)
-2: ret
+1: fsts 4(%esp)
+ ret
diff --git a/src/math/i386/atan2.s b/src/math/i386/atan2.s
index a7d2979b..1fa0524d 100644
--- a/src/math/i386/atan2.s
+++ b/src/math/i386/atan2.s
@@ -10,8 +10,5 @@ atan2:
cmp $0x00200000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 1f
fsts 4(%esp)
-1: ret
+ ret
diff --git a/src/math/i386/atan2f.s b/src/math/i386/atan2f.s
index 14b88ce5..0b264726 100644
--- a/src/math/i386/atan2f.s
+++ b/src/math/i386/atan2f.s
@@ -10,10 +10,7 @@ atan2f:
cmp $0x01000000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 1f
fld %st(0)
fmul %st(1)
fstps 4(%esp)
-1: ret
+ ret
diff --git a/src/math/i386/atanf.s b/src/math/i386/atanf.s
index 8caddefa..893beac5 100644
--- a/src/math/i386/atanf.s
+++ b/src/math/i386/atanf.s
@@ -10,10 +10,7 @@ atanf:
fpatan
ret
# subnormal x, return x with underflow
-1: fnstsw %ax
- and $16,%ax
- jnz 2f
- fld %st(0)
+1: fld %st(0)
fmul %st(1)
fstps 4(%esp)
-2: ret
+ ret
diff --git a/src/math/i386/exp.s b/src/math/i386/exp.s
index c7aa5b6e..df87c497 100644
--- a/src/math/i386/exp.s
+++ b/src/math/i386/exp.s
@@ -7,13 +7,10 @@ expm1f:
cmp $0x01000000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 2f
fld %st(0)
fmul %st(1)
fstps 4(%esp)
-2: ret
+ ret
.global expm1l
.type expm1l,@function
@@ -30,11 +27,8 @@ expm1:
cmp $0x00200000,%eax
jae 1f
# subnormal x, return x with underflow
- fnstsw %ax
- and $16,%ax
- jnz 2f
fsts 4(%esp)
-2: ret
+ ret
1: fldl2e
fmulp
mov $0xc2820000,%eax
diff --git a/src/math/i386/log1p.s b/src/math/i386/log1p.s
index 6b6929c7..354f391a 100644
--- a/src/math/i386/log1p.s
+++ b/src/math/i386/log1p.s
@@ -16,9 +16,6 @@ log1p:
fyl2x
ret
# subnormal x, return x with underflow
-2: fnstsw %ax
- and $16,%ax
- jnz 1f
- fsts 4(%esp)
+2: fsts 4(%esp)
fstp %st(1)
-1: ret
+ ret
diff --git a/src/math/i386/log1pf.s b/src/math/i386/log1pf.s
index c0bcd30f..4d3484cd 100644
--- a/src/math/i386/log1pf.s
+++ b/src/math/i386/log1pf.s
@@ -16,10 +16,7 @@ log1pf:
fyl2x
ret
# subnormal x, return x with underflow
-2: fnstsw %ax
- and $16,%ax
- jnz 1f
- fxch
+2: fxch
fmul %st(1)
fstps 4(%esp)
-1: ret
+ ret
--
cgit v1.2.1
From 6818c31c9bc4bbad5357f1de14bedf781e5b349e Mon Sep 17 00:00:00 2001
From: Rich Felker <dalias@aerifal.cx>
Date: Mon, 5 Aug 2019 19:57:07 -0400
Subject: fix build regression in i386 asm for atan2, atan2f
commit f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441 inadvertently removed
labels that were still needed.
---
src/math/i386/atan2.s | 2 +-
src/math/i386/atan2f.s | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/math/i386/atan2.s b/src/math/i386/atan2.s
index 1fa0524d..76b95f31 100644
--- a/src/math/i386/atan2.s
+++ b/src/math/i386/atan2.s
@@ -11,4 +11,4 @@ atan2:
jae 1f
# subnormal x, return x with underflow
fsts 4(%esp)
- ret
+1: ret
diff --git a/src/math/i386/atan2f.s b/src/math/i386/atan2f.s
index 0b264726..c9408a90 100644
--- a/src/math/i386/atan2f.s
+++ b/src/math/i386/atan2f.s
@@ -13,4 +13,4 @@ atan2f:
fld %st(0)
fmul %st(1)
fstps 4(%esp)
- ret
+1: ret
--
cgit v1.2.1
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment