]> git.ipfire.org Git - ipfire-2.x.git/blob - src/patches/glibc/glibc-rh847932.patch
lcdproc: Update to 0.5.7
[ipfire-2.x.git] / src / patches / glibc / glibc-rh847932.patch
1 diff -Nrup a/stdlib/Makefile b/stdlib/Makefile
2 --- a/stdlib/Makefile 2010-05-04 05:27:23.000000000 -0600
3 +++ b/stdlib/Makefile 2012-08-15 09:25:37.812443006 -0600
4 @@ -71,7 +71,7 @@ tests := tst-strtol tst-strtod testmb t
5 tst-atof1 tst-atof2 tst-strtod2 tst-strtod3 tst-rand48-2 \
6 tst-makecontext tst-strtod4 tst-strtod5 tst-qsort2 \
7 tst-makecontext2 tst-strtod6 tst-unsetenv1 \
8 - tst-makecontext3
9 + tst-makecontext3 tst-strtod-overflow
10
11 include ../Makeconfig
12
13 diff -Nrup a/stdlib/strtod_l.c b/stdlib/strtod_l.c
14 --- a/stdlib/strtod_l.c 2010-05-04 05:27:23.000000000 -0600
15 +++ b/stdlib/strtod_l.c 2012-08-15 09:34:29.550281346 -0600
16 @@ -62,6 +62,7 @@ extern unsigned long long int ____strtou
17 #include <math.h>
18 #include <stdlib.h>
19 #include <string.h>
20 +#include <stdint.h>
21
22 /* The gmp headers need some configuration frobs. */
23 #define HAVE_ALLOCA 1
24 @@ -176,19 +177,19 @@ extern const mp_limb_t _tens_in_limb[MAX
25 /* Return a floating point number of the needed type according to the given
26 multi-precision number after possible rounding. */
27 static FLOAT
28 -round_and_return (mp_limb_t *retval, int exponent, int negative,
29 +round_and_return (mp_limb_t *retval, intmax_t exponent, int negative,
30 mp_limb_t round_limb, mp_size_t round_bit, int more_bits)
31 {
32 if (exponent < MIN_EXP - 1)
33 {
34 - mp_size_t shift = MIN_EXP - 1 - exponent;
35 -
36 - if (shift > MANT_DIG)
37 + if (exponent < MIN_EXP - 1 - MANT_DIG)
38 {
39 __set_errno (EDOM);
40 return 0.0;
41 }
42
43 + mp_size_t shift = MIN_EXP - 1 - exponent;
44 +
45 more_bits |= (round_limb & ((((mp_limb_t) 1) << round_bit) - 1)) != 0;
46 if (shift == MANT_DIG)
47 /* This is a special case to handle the very seldom case where
48 @@ -235,6 +236,9 @@ round_and_return (mp_limb_t *retval, int
49 __set_errno (ERANGE);
50 }
51
52 + if (exponent > MAX_EXP)
53 + goto overflow;
54 +
55 if ((round_limb & (((mp_limb_t) 1) << round_bit)) != 0
56 && (more_bits || (retval[0] & 1) != 0
57 || (round_limb & ((((mp_limb_t) 1) << round_bit) - 1)) != 0))
58 @@ -260,6 +264,7 @@ round_and_return (mp_limb_t *retval, int
59 }
60
61 if (exponent > MAX_EXP)
62 + overflow:
63 return negative ? -FLOAT_HUGE_VAL : FLOAT_HUGE_VAL;
64
65 return MPN2FLOAT (retval, exponent, negative);
66 @@ -273,7 +278,7 @@ round_and_return (mp_limb_t *retval, int
67 factor for the resulting number (see code) multiply by it. */
68 static const STRING_TYPE *
69 str_to_mpn (const STRING_TYPE *str, int digcnt, mp_limb_t *n, mp_size_t *nsize,
70 - int *exponent
71 + intmax_t *exponent
72 #ifndef USE_WIDE_CHAR
73 , const char *decimal, size_t decimal_len, const char *thousands
74 #endif
75 @@ -337,7 +342,7 @@ str_to_mpn (const STRING_TYPE *str, int
76 }
77 while (--digcnt > 0);
78
79 - if (*exponent > 0 && cnt + *exponent <= MAX_DIG_PER_LIMB)
80 + if (*exponent > 0 && *exponent <= MAX_DIG_PER_LIMB - cnt)
81 {
82 low *= _tens_in_limb[*exponent];
83 start = _tens_in_limb[cnt + *exponent];
84 @@ -415,7 +420,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
85 {
86 int negative; /* The sign of the number. */
87 MPN_VAR (num); /* MP representation of the number. */
88 - int exponent; /* Exponent of the number. */
89 + intmax_t exponent; /* Exponent of the number. */
90
91 /* Numbers starting `0X' or `0x' have to be processed with base 16. */
92 int base = 10;
93 @@ -437,7 +442,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
94 /* Points at the character following the integer and fractional digits. */
95 const STRING_TYPE *expp;
96 /* Total number of digit and number of digits in integer part. */
97 - int dig_no, int_no, lead_zero;
98 + size_t dig_no, int_no, lead_zero;
99 /* Contains the last character read. */
100 CHAR_TYPE c;
101
102 @@ -769,7 +774,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
103 are all or any is really a fractional digit will be decided
104 later. */
105 int_no = dig_no;
106 - lead_zero = int_no == 0 ? -1 : 0;
107 + lead_zero = int_no == 0 ? (size_t) -1 : 0;
108
109 /* Read the fractional digits. A special case are the 'american
110 style' numbers like `16.' i.e. with decimal point but without
111 @@ -791,12 +796,13 @@ ____STRTOF_INTERNAL (nptr, endptr, group
112 (base == 16 && ({ CHAR_TYPE lo = TOLOWER (c);
113 lo >= L_('a') && lo <= L_('f'); })))
114 {
115 - if (c != L_('0') && lead_zero == -1)
116 + if (c != L_('0') && lead_zero == (size_t) -1)
117 lead_zero = dig_no - int_no;
118 ++dig_no;
119 c = *++cp;
120 }
121 }
122 + assert (dig_no <= (uintmax_t) INTMAX_MAX);
123
124 /* Remember start of exponent (if any). */
125 expp = cp;
126 @@ -819,24 +825,80 @@ ____STRTOF_INTERNAL (nptr, endptr, group
127
128 if (c >= L_('0') && c <= L_('9'))
129 {
130 - int exp_limit;
131 + intmax_t exp_limit;
132
133 /* Get the exponent limit. */
134 if (base == 16)
135 - exp_limit = (exp_negative ?
136 - -MIN_EXP + MANT_DIG + 4 * int_no :
137 - MAX_EXP - 4 * int_no + 4 * lead_zero + 3);
138 + {
139 + if (exp_negative)
140 + {
141 + assert (int_no <= (uintmax_t) (INTMAX_MAX
142 + + MIN_EXP - MANT_DIG) / 4);
143 + exp_limit = -MIN_EXP + MANT_DIG + 4 * (intmax_t) int_no;
144 + }
145 + else
146 + {
147 + if (int_no)
148 + {
149 + assert (lead_zero == 0
150 + && int_no <= (uintmax_t) INTMAX_MAX / 4);
151 + exp_limit = MAX_EXP - 4 * (intmax_t) int_no + 3;
152 + }
153 + else if (lead_zero == (size_t) -1)
154 + {
155 + /* The number is zero and this limit is
156 + arbitrary. */
157 + exp_limit = MAX_EXP + 3;
158 + }
159 + else
160 + {
161 + assert (lead_zero
162 + <= (uintmax_t) (INTMAX_MAX - MAX_EXP - 3) / 4);
163 + exp_limit = (MAX_EXP
164 + + 4 * (intmax_t) lead_zero
165 + + 3);
166 + }
167 + }
168 + }
169 else
170 - exp_limit = (exp_negative ?
171 - -MIN_10_EXP + MANT_DIG + int_no :
172 - MAX_10_EXP - int_no + lead_zero + 1);
173 + {
174 + if (exp_negative)
175 + {
176 + assert (int_no
177 + <= (uintmax_t) (INTMAX_MAX + MIN_10_EXP - MANT_DIG));
178 + exp_limit = -MIN_10_EXP + MANT_DIG + (intmax_t) int_no;
179 + }
180 + else
181 + {
182 + if (int_no)
183 + {
184 + assert (lead_zero == 0
185 + && int_no <= (uintmax_t) INTMAX_MAX);
186 + exp_limit = MAX_10_EXP - (intmax_t) int_no + 1;
187 + }
188 + else if (lead_zero == (size_t) -1)
189 + {
190 + /* The number is zero and this limit is
191 + arbitrary. */
192 + exp_limit = MAX_10_EXP + 1;
193 + }
194 + else
195 + {
196 + assert (lead_zero
197 + <= (uintmax_t) (INTMAX_MAX - MAX_10_EXP - 1));
198 + exp_limit = MAX_10_EXP + (intmax_t) lead_zero + 1;
199 + }
200 + }
201 + }
202 +
203 + if (exp_limit < 0)
204 + exp_limit = 0;
205
206 do
207 {
208 - exponent *= 10;
209 - exponent += c - L_('0');
210 -
211 - if (__builtin_expect (exponent > exp_limit, 0))
212 + if (__builtin_expect ((exponent > exp_limit / 10
213 + || (exponent == exp_limit / 10
214 + && c - L_('0') > exp_limit % 10)), 0))
215 /* The exponent is too large/small to represent a valid
216 number. */
217 {
218 @@ -845,7 +907,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
219 /* We have to take care for special situation: a joker
220 might have written "0.0e100000" which is in fact
221 zero. */
222 - if (lead_zero == -1)
223 + if (lead_zero == (size_t) -1)
224 result = negative ? -0.0 : 0.0;
225 else
226 {
227 @@ -864,6 +926,9 @@ ____STRTOF_INTERNAL (nptr, endptr, group
228 /* NOTREACHED */
229 }
230
231 + exponent *= 10;
232 + exponent += c - L_('0');
233 +
234 c = *++cp;
235 }
236 while (c >= L_('0') && c <= L_('9'));
237 @@ -932,7 +997,14 @@ ____STRTOF_INTERNAL (nptr, endptr, group
238 }
239 #endif
240 startp += lead_zero + decimal_len;
241 - exponent -= base == 16 ? 4 * lead_zero : lead_zero;
242 + assert (lead_zero <= (base == 16
243 + ? (uintmax_t) INTMAX_MAX / 4
244 + : (uintmax_t) INTMAX_MAX));
245 + assert (lead_zero <= (base == 16
246 + ? ((uintmax_t) exponent
247 + - (uintmax_t) INTMAX_MIN) / 4
248 + : ((uintmax_t) exponent - (uintmax_t) INTMAX_MIN)));
249 + exponent -= base == 16 ? 4 * (intmax_t) lead_zero : (intmax_t) lead_zero;
250 dig_no -= lead_zero;
251 }
252
253 @@ -974,7 +1046,10 @@ ____STRTOF_INTERNAL (nptr, endptr, group
254 }
255
256 /* Adjust the exponent for the bits we are shifting in. */
257 - exponent += bits - 1 + (int_no - 1) * 4;
258 + assert (int_no <= (uintmax_t) (exponent < 0
259 + ? (INTMAX_MAX - bits + 1) / 4
260 + : (INTMAX_MAX - exponent - bits + 1) / 4));
261 + exponent += bits - 1 + ((intmax_t) int_no - 1) * 4;
262
263 while (--dig_no > 0 && idx >= 0)
264 {
265 @@ -1014,13 +1089,15 @@ ____STRTOF_INTERNAL (nptr, endptr, group
266 really integer digits or belong to the fractional part; i.e. we normalize
267 123e-2 to 1.23. */
268 {
269 - register int incr = (exponent < 0 ? MAX (-int_no, exponent)
270 - : MIN (dig_no - int_no, exponent));
271 + register intmax_t incr = (exponent < 0
272 + ? MAX (-(intmax_t) int_no, exponent)
273 + : MIN ((intmax_t) dig_no - (intmax_t) int_no,
274 + exponent));
275 int_no += incr;
276 exponent -= incr;
277 }
278
279 - if (__builtin_expect (int_no + exponent > MAX_10_EXP + 1, 0))
280 + if (__builtin_expect (exponent > MAX_10_EXP + 1 - (intmax_t) int_no, 0))
281 {
282 __set_errno (ERANGE);
283 return negative ? -FLOAT_HUGE_VAL : FLOAT_HUGE_VAL;
284 @@ -1205,7 +1282,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
285 digits we should have enough bits for the result. The remaining
286 decimal digits give us the information that more bits are following.
287 This can be used while rounding. (Two added as a safety margin.) */
288 - if (dig_no - int_no > (MANT_DIG - bits + 2) / 3 + 2)
289 + if ((intmax_t) dig_no > (intmax_t) int_no + (MANT_DIG - bits + 2) / 3 + 2)
290 {
291 dig_no = int_no + (MANT_DIG - bits + 2) / 3 + 2;
292 more_bits = 1;
293 @@ -1213,7 +1290,7 @@ ____STRTOF_INTERNAL (nptr, endptr, group
294 else
295 more_bits = 0;
296
297 - neg_exp = dig_no - int_no - exponent;
298 + neg_exp = (intmax_t) dig_no - (intmax_t) int_no - exponent;
299
300 /* Construct the denominator. */
301 densize = 0;
302 @@ -1491,7 +1568,9 @@ ____STRTOF_INTERNAL (nptr, endptr, group
303 register int i;
304 (void) __mpn_lshift (&retval[used
305 / BITS_PER_MP_LIMB],
306 - retval, RETURN_LIMB_SIZE,
307 + retval,
308 + (RETURN_LIMB_SIZE
309 + - used / BITS_PER_MP_LIMB),
310 used % BITS_PER_MP_LIMB);
311 for (i = used / BITS_PER_MP_LIMB - 1; i >= 0; --i)
312 retval[i] = 0;
313 diff -Nrup a/stdlib/tst-strtod-overflow.c b/stdlib/tst-strtod-overflow.c
314 --- a/stdlib/tst-strtod-overflow.c 1969-12-31 17:00:00.000000000 -0700
315 +++ b/stdlib/tst-strtod-overflow.c 2012-08-15 09:25:01.098592764 -0600
316 @@ -0,0 +1,48 @@
317 +/* Test for integer/buffer overflow in strtod.
318 + Copyright (C) 2012 Free Software Foundation, Inc.
319 + This file is part of the GNU C Library.
320 +
321 + The GNU C Library is free software; you can redistribute it and/or
322 + modify it under the terms of the GNU Lesser General Public
323 + License as published by the Free Software Foundation; either
324 + version 2.1 of the License, or (at your option) any later version.
325 +
326 + The GNU C Library is distributed in the hope that it will be useful,
327 + but WITHOUT ANY WARRANTY; without even the implied warranty of
328 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
329 + Lesser General Public License for more details.
330 +
331 + You should have received a copy of the GNU Lesser General Public
332 + License along with the GNU C Library; if not, see
333 + <http://www.gnu.org/licenses/>. */
334 +
335 +#include <stdio.h>
336 +#include <stdlib.h>
337 +#include <string.h>
338 +
339 +#define EXPONENT "e-2147483649"
340 +#define SIZE 214748364
341 +
342 +static int
343 +do_test (void)
344 +{
345 + char *p = malloc (1 + SIZE + sizeof (EXPONENT));
346 + if (p == NULL)
347 + {
348 + puts ("malloc failed, cannot test for overflow");
349 + return 0;
350 + }
351 + p[0] = '1';
352 + memset (p + 1, '0', SIZE);
353 + memcpy (p + 1 + SIZE, EXPONENT, sizeof (EXPONENT));
354 + double d = strtod (p, NULL);
355 + if (d != 0)
356 + {
357 + printf ("strtod returned wrong value: %a\n", d);
358 + return 1;
359 + }
360 + return 0;
361 +}
362 +
363 +#define TEST_FUNCTION do_test ()
364 +#include "../test-skeleton.c"