diff options
author | Alexey Neyman <stilor@att.net> | 2017-08-26 12:29:34 -0700 |
---|---|---|
committer | Alexey Neyman <stilor@att.net> | 2017-08-26 13:01:44 -0700 |
commit | 8aa8a2cbc9c9a34a099c41f9781543f34d39c40b (patch) | |
tree | cf7371b80f480e1d2ae8f6b1c46f7d6ac20ef4e0 /packages/glibc/2.14/920-fix-rpc_parse-format.patch | |
parent | 5324905c1446d898d9a8f578555c1e54a2fbc89c (diff) | |
download | crosstool-ng-8aa8a2cbc9c9a34a099c41f9781543f34d39c40b.tar.gz crosstool-ng-8aa8a2cbc9c9a34a099c41f9781543f34d39c40b.tar.bz2 crosstool-ng-8aa8a2cbc9c9a34a099c41f9781543f34d39c40b.zip |
Missed glibc 2.14 when obsoleting releases
Superseded on the branch by 2.14.1.
Signed-off-by: Alexey Neyman <stilor@att.net>
Diffstat (limited to 'packages/glibc/2.14/920-fix-rpc_parse-format.patch')
-rw-r--r-- | packages/glibc/2.14/920-fix-rpc_parse-format.patch | 60 |
1 files changed, 0 insertions, 60 deletions
diff --git a/packages/glibc/2.14/920-fix-rpc_parse-format.patch b/packages/glibc/2.14/920-fix-rpc_parse-format.patch deleted file mode 100644 index 37e58dac..00000000 --- a/packages/glibc/2.14/920-fix-rpc_parse-format.patch +++ /dev/null @@ -1,60 +0,0 @@ -commit 5874510faaf3cbd0bb112aaacab9f225002beed1 -Author: Joseph Myers <joseph@codesourcery.com> -Date: Tue Nov 8 23:44:51 2016 +0000 - - Fix rpcgen buffer overrun (bug 20790). - - Building with GCC 7 produces an error building rpcgen: - - rpc_parse.c: In function 'get_prog_declaration': - rpc_parse.c:543:25: error: may write a terminating nul past the end of the destination [-Werror=format-length=] - sprintf (name, "%s%d", ARGNAME, num); /* default name of argument */ - ~~~~^ - rpc_parse.c:543:5: note: format output between 5 and 14 bytes into a destination of size 10 - sprintf (name, "%s%d", ARGNAME, num); /* default name of argument */ - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - - That buffer overrun is for the case where the .x file declares a - program with a million arguments. The strcpy two lines above can - generate a buffer overrun much more simply for a long argument name. - - The limit on length of line read by rpcgen (MAXLINESIZE == 1024) - provides a bound on the buffer size needed, so this patch just changes - the buffer size to MAXLINESIZE to avoid both possible buffer - overruns. A testcase is added that rpcgen does not crash with a - 500-character argument name, where it previously crashed. - - It would not at all surprise me if there are many other ways of - crashing rpcgen with either valid or invalid input; fuzz testing would - likely find various such bugs, though I don't think they are that - important to fix (rpcgen is not that likely to be used with untrusted - .x files as input). (As well as fuzz-findable bugs there are probably - also issues when various int variables get overflowed on very large - input.) The test infrastructure for rpcgen-not-crashing tests would - need extending if tests are to be added for cases where rpcgen should - produce an error, as opposed to cases where it should succeed. - - Tested for x86_64 and x86. - - [BZ #20790] - * sunrpc/rpc_parse.c (get_prog_declaration): Increase buffer size - to MAXLINESIZE. - * sunrpc/bug20790.x: New file. - * sunrpc/Makefile [$(run-built-tests) = yes] (rpcgen-tests): New - variable. - [$(run-built-tests) = yes] (tests-special): Add $(rpcgen-tests). - [$(run-built-tests) = yes] ($(rpcgen-tests)): New rule. - -diff --git a/sunrpc/rpc_parse.c b/sunrpc/rpc_parse.c -index 1a1df6d8c2..505a6554cf 100644 ---- a/sunrpc/rpc_parse.c -+++ b/sunrpc/rpc_parse.c -@@ -521,7 +521,7 @@ static void - get_prog_declaration (declaration * dec, defkind dkind, int num /* arg number */ ) - { - token tok; -- char name[10]; /* argument name */ -+ char name[MAXLINESIZE]; /* argument name */ - - if (dkind == DEF_PROGRAM) - { |