[people/teissler/ipfire-2.x.git] / src / patches / glibc / glibc-rh757888.patch

commit f3a6cc0a560a17f32a3e90d2f20501a53cab6058
Author: Andreas Schwab <schwab@redhat.com>
Date:   Tue Nov 29 10:52:22 2011 +0100

    Fix access after end of search string in regex matcher

diff --git a/locale/weight.h b/locale/weight.h
index dc70a00..967e176 100644
--- a/locale/weight.h
+++ b/locale/weight.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004 Free Software Foundation, Inc.
+/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper, <drepper@cygnus.com>.
 
@@ -20,7 +20,7 @@
 /* Find index of weight.  */
 auto inline int32_t
 __attribute ((always_inline))
-findidx (const unsigned char **cpp)
+findidx (const unsigned char **cpp, size_t len)
 {
   int_fast32_t i = table[*(*cpp)++];
   const unsigned char *cp;
@@ -34,6 +34,7 @@ findidx (const unsigned char **cpp)
      Search for the correct one.  */
   cp = &extra[-i];
   usrc = *cpp;
+  --len;
   while (1)
     {
       size_t nhere;
@@ -56,7 +57,7 @@ findidx (const unsigned char **cpp)
 	     already.  */
 	  size_t cnt;
 
-	  for (cnt = 0; cnt < nhere; ++cnt)
+	  for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
 	    if (cp[cnt] != usrc[cnt])
 	      break;
 
@@ -79,13 +80,13 @@ findidx (const unsigned char **cpp)
 	  size_t cnt;
 	  size_t offset = 0;
 
-	  for (cnt = 0; cnt < nhere; ++cnt)
+	  for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
 	    if (cp[cnt] != usrc[cnt])
 	      break;
 
 	  if (cnt != nhere)
 	    {
-	      if (cp[cnt] > usrc[cnt])
+	      if (cnt == len || cp[cnt] > usrc[cnt])
 		{
 		  /* Cannot be in this range.  */
 		  cp += 2 * nhere;
diff --git a/locale/weightwc.h b/locale/weightwc.h
index 9ea1126..7862091 100644
--- a/locale/weightwc.h
+++ b/locale/weightwc.h
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-2001,2003,2004,2005,2007 Free Software Foundation, Inc.
+/* Copyright (C) 1996-2001,2003,2004,2005,2007,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper, <drepper@cygnus.com>.
 
@@ -20,7 +20,7 @@
 /* Find index of weight.  */
 auto inline int32_t
 __attribute ((always_inline))
-findidx (const wint_t **cpp)
+findidx (const wint_t **cpp, size_t len)
 {
   wint_t ch = *(*cpp)++;
   int32_t i = __collidx_table_lookup ((const char *) table, ch);
@@ -32,6 +32,7 @@ findidx (const wint_t **cpp)
   /* Oh well, more than one sequence starting with this byte.
      Search for the correct one.  */
   const int32_t *cp = (const int32_t *) &extra[-i];
+  --len;
   while (1)
     {
       size_t nhere;
@@ -54,7 +55,7 @@ findidx (const wint_t **cpp)
 	     already.  */
 	  size_t cnt;
 
-	  for (cnt = 0; cnt < nhere; ++cnt)
+	  for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
 	    if (cp[cnt] != usrc[cnt])
 	      break;
 
@@ -75,7 +76,7 @@ findidx (const wint_t **cpp)
 	  size_t cnt;
 	  size_t offset;
 
-	  for (cnt = 0; cnt < nhere - 1; ++cnt)
+	  for (cnt = 0; cnt < nhere - 1 && cnt < len; ++cnt)
 	    if (cp[cnt] != usrc[cnt])
 	      break;
 
diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
index 18a6667..72bd3ee 100644
--- a/posix/fnmatch_loop.c
+++ b/posix/fnmatch_loop.c
@@ -412,7 +412,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 			  _NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
 # endif
 
-			idx = findidx (&cp);
+			idx = findidx (&cp, 1);
 			if (idx != 0)
 			  {
 			    /* We found a table entry.  Now see whether the
@@ -422,7 +422,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 			    int32_t idx2;
 			    const UCHAR *np = (const UCHAR *) n;
 
-			    idx2 = findidx (&np);
+			    idx2 = findidx (&np, string_end - n);
 			    if (idx2 != 0
 				&& (idx >> 24) == (idx2 >> 24)
 				&& len == weights[idx2 & 0xffffff])
diff --git a/posix/regcomp.c b/posix/regcomp.c
index b238c08..34ee845 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -1,5 +1,5 @@
 /* Extended regular expression matching and search library.
-   Copyright (C) 2002-2007,2009,2010 Free Software Foundation, Inc.
+   Copyright (C) 2002-2007,2009,2010,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Isamu Hasegawa <isamu@yamato.ibm.com>.
 
@@ -3409,19 +3409,18 @@ build_equiv_class (bitset_t sbcset, const unsigned char *name)
 						   _NL_COLLATE_EXTRAMB);
       indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
 						_NL_COLLATE_INDIRECTMB);
-      idx1 = findidx (&cp);
-      if (BE (idx1 == 0 || cp < name + strlen ((const char *) name), 0))
+      idx1 = findidx (&cp, -1);
+      if (BE (idx1 == 0 || *cp != '\0', 0))
 	/* This isn't a valid character.  */
 	return REG_ECOLLATE;
 
       /* Build single byte matcing table for this equivalence class.  */
-      char_buf[1] = (unsigned char) '\0';
       len = weights[idx1 & 0xffffff];
       for (ch = 0; ch < SBC_MAX; ++ch)
 	{
 	  char_buf[0] = ch;
 	  cp = char_buf;
-	  idx2 = findidx (&cp);
+	  idx2 = findidx (&cp, 1);
 /*
 	  idx2 = table[ch];
 */

--- a/posix/regex_internal.h	2011-11-30 12:47:02.706567482 -0700
+++ a/posix/regex_internal.h	2011-11-30 12:47:32.969558337 -0700
@@ -756,7 +756,7 @@
       indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
 						_NL_COLLATE_INDIRECTMB);
       p = pstr->mbs + idx;
-      tmp = findidx (&p);
+      tmp = findidx (&p, pstr->len - idx);
       return p - pstr->mbs - idx;
     }
   else
diff --git a/posix/regexec.c b/posix/regexec.c
index 9e0c565..3ea810b 100644
--- a/posix/regexec.c
+++ b/posix/regexec.c
@@ -3924,7 +3924,7 @@ check_node_accept_bytes (const re_dfa_t *dfa, int node_idx,
 		_NL_CURRENT (LC_COLLATE, _NL_COLLATE_EXTRAMB);
 	      indirect = (const int32_t *)
 		_NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
-	      int32_t idx = findidx (&cp);
+	      int32_t idx = findidx (&cp, elem_len);
 	      if (idx > 0)
 		for (i = 0; i < cset->nequiv_classes; ++i)
 		  {
diff --git a/string/strcoll_l.c b/string/strcoll_l.c
index d8d1139..fb77d08 100644
--- a/string/strcoll_l.c
+++ b/string/strcoll_l.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1995-1997,2002,2004,2007,2010 Free Software Foundation, Inc.
+/* Copyright (C) 1995-1997,2002,2004,2007,2010,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper <drepper@gnu.org>, 1995.
 
@@ -205,7 +205,7 @@ STRCOLL (s1, s2, l)
 
 		while (*us1 != L('\0'))
 		  {
-		    int32_t tmp = findidx (&us1);
+		    int32_t tmp = findidx (&us1, -1);
 		    rule1arr[idx1max] = tmp >> 24;
 		    idx1arr[idx1max] = tmp & 0xffffff;
 		    idx1cnt = idx1max++;
@@ -267,7 +267,7 @@ STRCOLL (s1, s2, l)
 
 		while (*us2 != L('\0'))
 		  {
-		    int32_t tmp = findidx (&us2);
+		    int32_t tmp = findidx (&us2, -1);
 		    rule2arr[idx2max] = tmp >> 24;
 		    idx2arr[idx2max] = tmp & 0xffffff;
 		    idx2cnt = idx2max++;
diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
index 220253c..b06556d 100644
--- a/string/strxfrm_l.c
+++ b/string/strxfrm_l.c
@@ -176,7 +176,7 @@ STRXFRM (STRING_TYPE *dest, const STRING_TYPE *src, size_t n, __locale_t l)
   idxmax = 0;
   do
     {
-      int32_t tmp = findidx (&usrc);
+      int32_t tmp = findidx (&usrc, -1);
       rulearr[idxmax] = tmp >> 24;
       idxarr[idxmax] = tmp & 0xffffff;
Commit	Line	Data
12788f63 MT	1	commit f3a6cc0a560a17f32a3e90d2f20501a53cab6058
	2	Author: Andreas Schwab <schwab@redhat.com>
	3	Date: Tue Nov 29 10:52:22 2011 +0100
	4
	5	Fix access after end of search string in regex matcher
	6
	7	diff --git a/locale/weight.h b/locale/weight.h
	8	index dc70a00..967e176 100644
	9	--- a/locale/weight.h
	10	+++ b/locale/weight.h
	11	@@ -1,4 +1,4 @@
	12	-/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004 Free Software Foundation, Inc.
	13	+/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004,2011 Free Software Foundation, Inc.
	14	This file is part of the GNU C Library.
	15	Written by Ulrich Drepper, <drepper@cygnus.com>.
	16
	17	@@ -20,7 +20,7 @@
	18	/* Find index of weight. */
	19	auto inline int32_t
	20	__attribute ((always_inline))
	21	-findidx (const unsigned char **cpp)
	22	+findidx (const unsigned char **cpp, size_t len)
	23	{
	24	int_fast32_t i = table[(cpp)++];
	25	const unsigned char *cp;
	26	@@ -34,6 +34,7 @@ findidx (const unsigned char **cpp)
	27	Search for the correct one. */
	28	cp = &extra[-i];
	29	usrc = *cpp;
	30	+ --len;
	31	while (1)
	32	{
	33	size_t nhere;
	34	@@ -56,7 +57,7 @@ findidx (const unsigned char **cpp)
	35	already. */
	36	size_t cnt;
	37
	38	- for (cnt = 0; cnt < nhere; ++cnt)
	39	+ for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
	40	if (cp[cnt] != usrc[cnt])
	41	break;
	42
	43	@@ -79,13 +80,13 @@ findidx (const unsigned char **cpp)
	44	size_t cnt;
	45	size_t offset = 0;
	46
	47	- for (cnt = 0; cnt < nhere; ++cnt)
	48	+ for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
	49	if (cp[cnt] != usrc[cnt])
	50	break;
	51
	52	if (cnt != nhere)
	53	{
	54	- if (cp[cnt] > usrc[cnt])
	55	+ if (cnt == len \|\| cp[cnt] > usrc[cnt])
	56	{
	57	/* Cannot be in this range. */
	58	cp += 2 * nhere;
	59	diff --git a/locale/weightwc.h b/locale/weightwc.h
	60	index 9ea1126..7862091 100644
	61	--- a/locale/weightwc.h
	62	+++ b/locale/weightwc.h
	63	@@ -1,4 +1,4 @@
	64	-/* Copyright (C) 1996-2001,2003,2004,2005,2007 Free Software Foundation, Inc.
65	+/* Copyright (C) 1996-2001,2003,2004,2005,2007,2011 Free Software Foundation, Inc.
66	This file is part of the GNU C Library.
67	Written by Ulrich Drepper, <drepper@cygnus.com>.
68
69	@@ -20,7 +20,7 @@
70	/* Find index of weight. */
71	auto inline int32_t
72	__attribute ((always_inline))
73	-findidx (const wint_t **cpp)
74	+findidx (const wint_t **cpp, size_t len)
75	{
76	wint_t ch = (cpp)++;
77	int32_t i = __collidx_table_lookup ((const char *) table, ch);
78	@@ -32,6 +32,7 @@ findidx (const wint_t **cpp)
79	/* Oh well, more than one sequence starting with this byte.
80	Search for the correct one. */
81	const int32_t cp = (const int32_t ) &extra[-i];
82	+ --len;
83	while (1)
84	{
85	size_t nhere;
86	@@ -54,7 +55,7 @@ findidx (const wint_t **cpp)
87	already. */
88	size_t cnt;
89
90	- for (cnt = 0; cnt < nhere; ++cnt)
91	+ for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
92	if (cp[cnt] != usrc[cnt])
93	break;
94
95	@@ -75,7 +76,7 @@ findidx (const wint_t **cpp)
96	size_t cnt;
97	size_t offset;
98
99	- for (cnt = 0; cnt < nhere - 1; ++cnt)
100	+ for (cnt = 0; cnt < nhere - 1 && cnt < len; ++cnt)
101	if (cp[cnt] != usrc[cnt])
102	break;
103
104	diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
105	index 18a6667..72bd3ee 100644
106	--- a/posix/fnmatch_loop.c
107	+++ b/posix/fnmatch_loop.c
108	@@ -412,7 +412,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
109	_NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
110	# endif
111
112	- idx = findidx (&cp);
113	+ idx = findidx (&cp, 1);
114	if (idx != 0)
115	{
116	/* We found a table entry. Now see whether the
117	@@ -422,7 +422,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
118	int32_t idx2;
119	const UCHAR np = (const UCHAR ) n;
120
121	- idx2 = findidx (&np);
122	+ idx2 = findidx (&np, string_end - n);
123	if (idx2 != 0
124	&& (idx >> 24) == (idx2 >> 24)
125	&& len == weights[idx2 & 0xffffff])
126	diff --git a/posix/regcomp.c b/posix/regcomp.c
127	index b238c08..34ee845 100644
128	--- a/posix/regcomp.c
129	+++ b/posix/regcomp.c
130	@@ -1,5 +1,5 @@
131	/* Extended regular expression matching and search library.
132	- Copyright (C) 2002-2007,2009,2010 Free Software Foundation, Inc.
133	+ Copyright (C) 2002-2007,2009,2010,2011 Free Software Foundation, Inc.
134	This file is part of the GNU C Library.
135	Contributed by Isamu Hasegawa <isamu@yamato.ibm.com>.
136
137	@@ -3409,19 +3409,18 @@ build_equiv_class (bitset_t sbcset, const unsigned char *name)
138	_NL_COLLATE_EXTRAMB);
139	indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
140	_NL_COLLATE_INDIRECTMB);
141	- idx1 = findidx (&cp);
142	- if (BE (idx1 == 0 \|\| cp < name + strlen ((const char *) name), 0))
143	+ idx1 = findidx (&cp, -1);
144	+ if (BE (idx1 == 0 \|\| *cp != '\0', 0))
145	/* This isn't a valid character. */
146	return REG_ECOLLATE;
147
148	/* Build single byte matcing table for this equivalence class. */
149	- char_buf[1] = (unsigned char) '\0';
150	len = weights[idx1 & 0xffffff];
151	for (ch = 0; ch < SBC_MAX; ++ch)
152	{
153	char_buf[0] = ch;
154	cp = char_buf;
155	- idx2 = findidx (&cp);
156	+ idx2 = findidx (&cp, 1);
157	/*
158	idx2 = table[ch];
159	*/
160
161	--- a/posix/regex_internal.h 2011-11-30 12:47:02.706567482 -0700
162	+++ a/posix/regex_internal.h 2011-11-30 12:47:32.969558337 -0700
163	@@ -756,7 +756,7 @@
164	indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
165	_NL_COLLATE_INDIRECTMB);
166	p = pstr->mbs + idx;
167	- tmp = findidx (&p);
168	+ tmp = findidx (&p, pstr->len - idx);
169	return p - pstr->mbs - idx;
170	}
171	else
172	diff --git a/posix/regexec.c b/posix/regexec.c
173	index 9e0c565..3ea810b 100644
174	--- a/posix/regexec.c
175	+++ b/posix/regexec.c
176	@@ -3924,7 +3924,7 @@ check_node_accept_bytes (const re_dfa_t *dfa, int node_idx,
177	_NL_CURRENT (LC_COLLATE, _NL_COLLATE_EXTRAMB);
178	indirect = (const int32_t *)
179	_NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
180	- int32_t idx = findidx (&cp);
181	+ int32_t idx = findidx (&cp, elem_len);
182	if (idx > 0)
183	for (i = 0; i < cset->nequiv_classes; ++i)
184	{
185	diff --git a/string/strcoll_l.c b/string/strcoll_l.c
186	index d8d1139..fb77d08 100644
187	--- a/string/strcoll_l.c
188	+++ b/string/strcoll_l.c
189	@@ -1,4 +1,4 @@
190	-/* Copyright (C) 1995-1997,2002,2004,2007,2010 Free Software Foundation, Inc.
191	+/* Copyright (C) 1995-1997,2002,2004,2007,2010,2011 Free Software Foundation, Inc.
192	This file is part of the GNU C Library.
193	Written by Ulrich Drepper <drepper@gnu.org>, 1995.
194
195	@@ -205,7 +205,7 @@ STRCOLL (s1, s2, l)
196
197	while (*us1 != L('\0'))
198	{
199	- int32_t tmp = findidx (&us1);
200	+ int32_t tmp = findidx (&us1, -1);
201	rule1arr[idx1max] = tmp >> 24;
202	idx1arr[idx1max] = tmp & 0xffffff;
203	idx1cnt = idx1max++;
204	@@ -267,7 +267,7 @@ STRCOLL (s1, s2, l)
205
206	while (*us2 != L('\0'))
207	{
208	- int32_t tmp = findidx (&us2);
209	+ int32_t tmp = findidx (&us2, -1);
210	rule2arr[idx2max] = tmp >> 24;
211	idx2arr[idx2max] = tmp & 0xffffff;
212	idx2cnt = idx2max++;
213	diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
214	index 220253c..b06556d 100644
215	--- a/string/strxfrm_l.c
216	+++ b/string/strxfrm_l.c
217	@@ -176,7 +176,7 @@ STRXFRM (STRING_TYPE dest, const STRING_TYPE src, size_t n, __locale_t l)
218	idxmax = 0;
219	do
220	{
221	- int32_t tmp = findidx (&usrc);
222	+ int32_t tmp = findidx (&usrc, -1);
223	rulearr[idxmax] = tmp >> 24;
224	idxarr[idxmax] = tmp & 0xffffff;
225