aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2019-08-07 09:13:59 +0200
committerNatanael Copa <ncopa@alpinelinux.org>2019-08-07 09:29:10 +0200
commitc07f44bfbb6aa1722bfc72f99ef20e2fd2a61ee4 (patch)
tree2b077eac42020aae73da490dfb69405ec99d931c
parentdc618a2b9d6d1536c6c73842abab1e837d344ea9 (diff)
downloadaports-c07f44bfbb6aa1722bfc72f99ef20e2fd2a61ee4.tar.gz
aports-c07f44bfbb6aa1722bfc72f99ef20e2fd2a61ee4.tar.bz2
aports-c07f44bfbb6aa1722bfc72f99ef20e2fd2a61ee4.tar.xz
main/musl: security fix in i386 math asm (CVE-2019-14697)
fixes #10709
-rw-r--r--main/musl/APKBUILD6
-rw-r--r--main/musl/CVE-2019-14697.patch233
2 files changed, 238 insertions, 1 deletions
diff --git a/main/musl/APKBUILD b/main/musl/APKBUILD
index a6ce6887d0..bd8c74c075 100644
--- a/main/musl/APKBUILD
+++ b/main/musl/APKBUILD
@@ -2,7 +2,7 @@
# Maintainer: Timo Teräs <timo.teras@iki.fi>
pkgname=musl
pkgver=1.1.18
-pkgrel=3
+pkgrel=4
pkgdesc="the musl c library (libc) implementation"
url="http://www.musl-libc.org/"
arch="all"
@@ -17,6 +17,7 @@ nolibc) ;;
*) subpackages="$subpackages $pkgname-utils";;
esac
source="http://www.musl-libc.org/releases/musl-$pkgver.tar.gz
+ CVE-2019-14697.patch
0001-fix-sysconf-for-infinite-rlimits.patch
0001-use-the-name-UTC-instead-of-GMT-for-UTC-timezone.patch
1000-implement-strftime-GNU-extension-padding-specifiers-.patch
@@ -31,6 +32,8 @@ source="http://www.musl-libc.org/releases/musl-$pkgver.tar.gz
"
# secfixes:
+# 1.1.18-r4:
+# - CVE-2019-14697
# 1.1.15-r4:
# - CVE-2016-8859
@@ -145,6 +148,7 @@ compat() {
}
sha512sums="4d55c92efe41dfdd9fff6aca5dda76a632a3be60d10e5a7f66a4731d8f7040fb0a20b998965ba4d069b4f8a3527fcd7388e646cb66afc649c4d0cc6c3d358c9c musl-1.1.18.tar.gz
+37ab61c96b940848e4114de105d87754c7039f52eb2fc19d8bf59c27f484bffbac8b4740e9478207eae03bd7416f7036e04197d0efe30ee5293b17d6d5c1cc15 CVE-2019-14697.patch
7b44cc006d37672a67bc261de33e64d11f6426fd1ab3ff80f9f980aefc8e0b099ab61f95d110eeb59f75c2fe772fe13bc5546c194c3f90ca9ec4c812dfff6b1b 0001-fix-sysconf-for-infinite-rlimits.patch
c28abac671f531d200bd1ebc934fc57b1c04404e49237dd6cfde4fe72e4fd8b855df0e75f76d62ec930c56daa00a12a6a3b3bb1c86576c7504fdf9628ad58975 0001-use-the-name-UTC-instead-of-GMT-for-UTC-timezone.patch
7e4c703e57a3564cd3ee1d5334b806cbe654355179ba55d4d25361dfc555eb4a7d081d80d64fdaff8476949afd04558d278b124d1fb108080beaa5ba2f8ce2b9 1000-implement-strftime-GNU-extension-padding-specifiers-.patch
diff --git a/main/musl/CVE-2019-14697.patch b/main/musl/CVE-2019-14697.patch
new file mode 100644
index 0000000000..eae91a00f9
--- /dev/null
+++ b/main/musl/CVE-2019-14697.patch
@@ -0,0 +1,233 @@
+From f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441 Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Mon, 5 Aug 2019 18:41:47 -0400
+Subject: fix x87 stack imbalance in corner cases of i386 math asm
+
+commit 31c5fb80b9eae86f801be4f46025bc6532a554c5 introduced underflow
+code paths for the i386 math asm, along with checks on the fpu status
+word to skip the underflow-generation instructions if the underflow
+flag was already raised. unfortunately, at least one such path, in
+log1p, returned with 2 items on the x87 stack rather than just 1 item
+for the return value. this is a violation of the ABI's calling
+convention, and could cause subsequent floating point code to produce
+NANs due to x87 stack overflow. if floating point results are used in
+flow control, this can lead to runaway wrong code execution.
+
+rather than reviewing each "underflow already raised" code path for
+correctness, remove them all. they're likely slower than just
+performing the underflow code unconditionally, and significantly more
+complex.
+
+all of this code should be ripped out and replaced by C source files
+with inline asm. doing so would preclude this kind of error by having
+the compiler perform all x87 stack register allocation and stack
+manipulation, and would produce comparable or better code. however
+such a change is a much larger project.
+---
+ src/math/i386/asin.s | 10 ++--------
+ src/math/i386/atan.s | 7 ++-----
+ src/math/i386/atan2.s | 5 +----
+ src/math/i386/atan2f.s | 5 +----
+ src/math/i386/atanf.s | 7 ++-----
+ src/math/i386/exp.s | 10 ++--------
+ src/math/i386/log1p.s | 7 ++-----
+ src/math/i386/log1pf.s | 7 ++-----
+ 8 files changed, 14 insertions(+), 44 deletions(-)
+
+diff --git a/src/math/i386/asin.s b/src/math/i386/asin.s
+index a9f691bf..920d967a 100644
+--- a/src/math/i386/asin.s
++++ b/src/math/i386/asin.s
+@@ -7,13 +7,10 @@ asinf:
+ cmp $0x01000000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 2f
+ fld %st(0)
+ fmul %st(1)
+ fstps 4(%esp)
+-2: ret
++ ret
+
+ .global asinl
+ .type asinl,@function
+@@ -30,11 +27,8 @@ asin:
+ cmp $0x00200000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 2f
+ fsts 4(%esp)
+-2: ret
++ ret
+ 1: fld %st(0)
+ fld1
+ fsub %st(0),%st(1)
+diff --git a/src/math/i386/atan.s b/src/math/i386/atan.s
+index d73137b2..a26feae1 100644
+--- a/src/math/i386/atan.s
++++ b/src/math/i386/atan.s
+@@ -10,8 +10,5 @@ atan:
+ fpatan
+ ret
+ # subnormal x, return x with underflow
+-1: fnstsw %ax
+- and $16,%ax
+- jnz 2f
+- fsts 4(%esp)
+-2: ret
++1: fsts 4(%esp)
++ ret
+diff --git a/src/math/i386/atan2.s b/src/math/i386/atan2.s
+index a7d2979b..1fa0524d 100644
+--- a/src/math/i386/atan2.s
++++ b/src/math/i386/atan2.s
+@@ -10,8 +10,5 @@ atan2:
+ cmp $0x00200000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 1f
+ fsts 4(%esp)
+-1: ret
++ ret
+diff --git a/src/math/i386/atan2f.s b/src/math/i386/atan2f.s
+index 14b88ce5..0b264726 100644
+--- a/src/math/i386/atan2f.s
++++ b/src/math/i386/atan2f.s
+@@ -10,10 +10,7 @@ atan2f:
+ cmp $0x01000000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 1f
+ fld %st(0)
+ fmul %st(1)
+ fstps 4(%esp)
+-1: ret
++ ret
+diff --git a/src/math/i386/atanf.s b/src/math/i386/atanf.s
+index 8caddefa..893beac5 100644
+--- a/src/math/i386/atanf.s
++++ b/src/math/i386/atanf.s
+@@ -10,10 +10,7 @@ atanf:
+ fpatan
+ ret
+ # subnormal x, return x with underflow
+-1: fnstsw %ax
+- and $16,%ax
+- jnz 2f
+- fld %st(0)
++1: fld %st(0)
+ fmul %st(1)
+ fstps 4(%esp)
+-2: ret
++ ret
+diff --git a/src/math/i386/exp.s b/src/math/i386/exp.s
+index c7aa5b6e..df87c497 100644
+--- a/src/math/i386/exp.s
++++ b/src/math/i386/exp.s
+@@ -7,13 +7,10 @@ expm1f:
+ cmp $0x01000000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 2f
+ fld %st(0)
+ fmul %st(1)
+ fstps 4(%esp)
+-2: ret
++ ret
+
+ .global expm1l
+ .type expm1l,@function
+@@ -30,11 +27,8 @@ expm1:
+ cmp $0x00200000,%eax
+ jae 1f
+ # subnormal x, return x with underflow
+- fnstsw %ax
+- and $16,%ax
+- jnz 2f
+ fsts 4(%esp)
+-2: ret
++ ret
+ 1: fldl2e
+ fmulp
+ mov $0xc2820000,%eax
+diff --git a/src/math/i386/log1p.s b/src/math/i386/log1p.s
+index 6b6929c7..354f391a 100644
+--- a/src/math/i386/log1p.s
++++ b/src/math/i386/log1p.s
+@@ -16,9 +16,6 @@ log1p:
+ fyl2x
+ ret
+ # subnormal x, return x with underflow
+-2: fnstsw %ax
+- and $16,%ax
+- jnz 1f
+- fsts 4(%esp)
++2: fsts 4(%esp)
+ fstp %st(1)
+-1: ret
++ ret
+diff --git a/src/math/i386/log1pf.s b/src/math/i386/log1pf.s
+index c0bcd30f..4d3484cd 100644
+--- a/src/math/i386/log1pf.s
++++ b/src/math/i386/log1pf.s
+@@ -16,10 +16,7 @@ log1pf:
+ fyl2x
+ ret
+ # subnormal x, return x with underflow
+-2: fnstsw %ax
+- and $16,%ax
+- jnz 1f
+- fxch
++2: fxch
+ fmul %st(1)
+ fstps 4(%esp)
+-1: ret
++ ret
+--
+cgit v1.2.1
+
+From 6818c31c9bc4bbad5357f1de14bedf781e5b349e Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Mon, 5 Aug 2019 19:57:07 -0400
+Subject: fix build regression in i386 asm for atan2, atan2f
+
+commit f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441 inadvertently removed
+labels that were still needed.
+---
+ src/math/i386/atan2.s | 2 +-
+ src/math/i386/atan2f.s | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/math/i386/atan2.s b/src/math/i386/atan2.s
+index 1fa0524d..76b95f31 100644
+--- a/src/math/i386/atan2.s
++++ b/src/math/i386/atan2.s
+@@ -11,4 +11,4 @@ atan2:
+ jae 1f
+ # subnormal x, return x with underflow
+ fsts 4(%esp)
+- ret
++1: ret
+diff --git a/src/math/i386/atan2f.s b/src/math/i386/atan2f.s
+index 0b264726..c9408a90 100644
+--- a/src/math/i386/atan2f.s
++++ b/src/math/i386/atan2f.s
+@@ -13,4 +13,4 @@ atan2f:
+ fld %st(0)
+ fmul %st(1)
+ fstps 4(%esp)
+- ret
++1: ret
+--
+cgit v1.2.1
+