From 3079f7966dbed4497e36d5067cbfd896a90358cb Mon Sep 17 00:00:00 2001
From: Cyrill Gorcunov <gorcunov@gmail.com>
Date: Wed, 14 Nov 2018 10:03:42 +0300
Subject: [PATCH] preproc: Fix malformed parameter count

readnum returns 64bit number which may become
a negative integer upon conversion which in
turn lead to out of bound array access.

Fix it by explicit conversion with bounds check

 | POC6:2: error: parameter count `2222222222' is out of bounds [0; 2147483647]

https://bugzilla.nasm.us/show_bug.cgi?id=3392528

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>

Upstream-Status: Backport
CVE: CVE-2018-19755
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
 asm/preproc.c | 43 +++++++++++++++++++++----------------------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/asm/preproc.c b/asm/preproc.c
index b6afee3..e5ad05a 100644
--- a/asm/preproc.c
+++ b/asm/preproc.c
@@ -1650,6 +1650,23 @@ smacro_defined(Context * ctx, const char *name, int nparam, SMacro ** defn,
     return false;
 }
 
+/* param should be a natural number [0; INT_MAX] */
+static int read_param_count(const char *str)
+{
+    int result;
+    bool err;
+
+    result = readnum(str, &err);
+    if (result < 0 || result > INT_MAX) {
+        result = 0;
+        nasm_error(ERR_NONFATAL, "parameter count `%s' is out of bounds [%d; %d]",
+                   str, 0, INT_MAX);
+    } else if (err) {
+        nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", str);
+    }
+    return result;
+}
+
 /*
  * Count and mark off the parameters in a multi-line macro call.
  * This is called both from within the multi-line macro expansion
@@ -1871,11 +1888,7 @@ static bool if_condition(Token * tline, enum preproc_token ct)
                   pp_directives[ct]);
         } else {
             searching.nparam_min = searching.nparam_max =
-                readnum(tline->text, &j);
-            if (j)
-                nasm_error(ERR_NONFATAL,
-                      "unable to parse parameter count `%s'",
-                      tline->text);
+                read_param_count(tline->text);
         }
         if (tline && tok_is_(tline->next, "-")) {
             tline = tline->next->next;
@@ -1886,11 +1899,7 @@ static bool if_condition(Token * tline, enum preproc_token ct)
                       "`%s' expects a parameter count after `-'",
                       pp_directives[ct]);
             else {
-                searching.nparam_max = readnum(tline->text, &j);
-                if (j)
-                    nasm_error(ERR_NONFATAL,
-                          "unable to parse parameter count `%s'",
-                          tline->text);
+                searching.nparam_max = read_param_count(tline->text);
                 if (searching.nparam_min > searching.nparam_max) {
                     nasm_error(ERR_NONFATAL,
                           "minimum parameter count exceeds maximum");
@@ -2079,8 +2088,6 @@ static void undef_smacro(Context *ctx, const char *mname)
  */
 static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
 {
-    bool err;
-
     tline = tline->next;
     skip_white_(tline);
     tline = expand_id(tline);
@@ -2103,11 +2110,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
     if (!tok_type_(tline, TOK_NUMBER)) {
         nasm_error(ERR_NONFATAL, "`%s' expects a parameter count", directive);
     } else {
-        def->nparam_min = def->nparam_max =
-            readnum(tline->text, &err);
-        if (err)
-            nasm_error(ERR_NONFATAL,
-                  "unable to parse parameter count `%s'", tline->text);
+        def->nparam_min = def->nparam_max = read_param_count(tline->text);
     }
     if (tline && tok_is_(tline->next, "-")) {
         tline = tline->next->next;
@@ -2117,11 +2120,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive)
             nasm_error(ERR_NONFATAL,
                   "`%s' expects a parameter count after `-'", directive);
         } else {
-            def->nparam_max = readnum(tline->text, &err);
-            if (err) {
-                nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'",
-                      tline->text);
-            }
+            def->nparam_max = read_param_count(tline->text);
             if (def->nparam_min > def->nparam_max) {
                 nasm_error(ERR_NONFATAL, "minimum parameter count exceeds maximum");
                 def->nparam_max = def->nparam_min;
-- 
2.10.5.GIT