| From 3079f7966dbed4497e36d5067cbfd896a90358cb Mon Sep 17 00:00:00 2001 |
| From: Cyrill Gorcunov <gorcunov@gmail.com> |
| Date: Wed, 14 Nov 2018 10:03:42 +0300 |
| Subject: [PATCH] preproc: Fix malformed parameter count |
| |
| readnum returns 64bit number which may become |
| a negative integer upon conversion which in |
| turn lead to out of bound array access. |
| |
| Fix it by explicit conversion with bounds check |
| |
| | POC6:2: error: parameter count `2222222222' is out of bounds [0; 2147483647] |
| |
| https://bugzilla.nasm.us/show_bug.cgi?id=3392528 |
| |
| Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> |
| |
| Upstream-Status: Backport |
| CVE: CVE-2018-19755 |
| Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| --- |
| asm/preproc.c | 43 +++++++++++++++++++++---------------------- |
| 1 file changed, 21 insertions(+), 22 deletions(-) |
| |
| diff --git a/asm/preproc.c b/asm/preproc.c |
| index b6afee3..e5ad05a 100644 |
| --- a/asm/preproc.c |
| +++ b/asm/preproc.c |
| @@ -1650,6 +1650,23 @@ smacro_defined(Context * ctx, const char *name, int nparam, SMacro ** defn, |
| return false; |
| } |
| |
| +/* param should be a natural number [0; INT_MAX] */ |
| +static int read_param_count(const char *str) |
| +{ |
| + int result; |
| + bool err; |
| + |
| + result = readnum(str, &err); |
| + if (result < 0 || result > INT_MAX) { |
| + result = 0; |
| + nasm_error(ERR_NONFATAL, "parameter count `%s' is out of bounds [%d; %d]", |
| + str, 0, INT_MAX); |
| + } else if (err) { |
| + nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", str); |
| + } |
| + return result; |
| +} |
| + |
| /* |
| * Count and mark off the parameters in a multi-line macro call. |
| * This is called both from within the multi-line macro expansion |
| @@ -1871,11 +1888,7 @@ static bool if_condition(Token * tline, enum preproc_token ct) |
| pp_directives[ct]); |
| } else { |
| searching.nparam_min = searching.nparam_max = |
| - readnum(tline->text, &j); |
| - if (j) |
| - nasm_error(ERR_NONFATAL, |
| - "unable to parse parameter count `%s'", |
| - tline->text); |
| + read_param_count(tline->text); |
| } |
| if (tline && tok_is_(tline->next, "-")) { |
| tline = tline->next->next; |
| @@ -1886,11 +1899,7 @@ static bool if_condition(Token * tline, enum preproc_token ct) |
| "`%s' expects a parameter count after `-'", |
| pp_directives[ct]); |
| else { |
| - searching.nparam_max = readnum(tline->text, &j); |
| - if (j) |
| - nasm_error(ERR_NONFATAL, |
| - "unable to parse parameter count `%s'", |
| - tline->text); |
| + searching.nparam_max = read_param_count(tline->text); |
| if (searching.nparam_min > searching.nparam_max) { |
| nasm_error(ERR_NONFATAL, |
| "minimum parameter count exceeds maximum"); |
| @@ -2079,8 +2088,6 @@ static void undef_smacro(Context *ctx, const char *mname) |
| */ |
| static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) |
| { |
| - bool err; |
| - |
| tline = tline->next; |
| skip_white_(tline); |
| tline = expand_id(tline); |
| @@ -2103,11 +2110,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) |
| if (!tok_type_(tline, TOK_NUMBER)) { |
| nasm_error(ERR_NONFATAL, "`%s' expects a parameter count", directive); |
| } else { |
| - def->nparam_min = def->nparam_max = |
| - readnum(tline->text, &err); |
| - if (err) |
| - nasm_error(ERR_NONFATAL, |
| - "unable to parse parameter count `%s'", tline->text); |
| + def->nparam_min = def->nparam_max = read_param_count(tline->text); |
| } |
| if (tline && tok_is_(tline->next, "-")) { |
| tline = tline->next->next; |
| @@ -2117,11 +2120,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) |
| nasm_error(ERR_NONFATAL, |
| "`%s' expects a parameter count after `-'", directive); |
| } else { |
| - def->nparam_max = readnum(tline->text, &err); |
| - if (err) { |
| - nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", |
| - tline->text); |
| - } |
| + def->nparam_max = read_param_count(tline->text); |
| if (def->nparam_min > def->nparam_max) { |
| nasm_error(ERR_NONFATAL, "minimum parameter count exceeds maximum"); |
| def->nparam_max = def->nparam_min; |
| -- |
| 2.10.5.GIT |
| |