Brad Bishop | 220d553 | 2018-08-14 00:59:39 +0100 | [diff] [blame] | 1 | From 7a46d6b9e3a1d8a0ab0d816ef1bf194ad285e082 Mon Sep 17 00:00:00 2001 |
| 2 | From: "Chang S. Bae" <chang.seok.bae@intel.com> |
| 3 | Date: Fri, 17 Aug 2018 14:26:03 +0800 |
| 4 | Subject: [PATCH] assemble: Check global line limit |
| 5 | |
| 6 | Without the limit, the while loop opens to semi-infinite |
| 7 | that will exhaustively consume the heap space. Also, the |
| 8 | index value gets into the garbage. |
| 9 | |
| 10 | https://bugzilla.nasm.us/show_bug.cgi?id=3392474 |
| 11 | |
| 12 | Reported-by : Dongliang Mu <mudongliangabcd@gmail.com> |
| 13 | Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com> |
| 14 | Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> |
| 15 | |
| 16 | Upstream-Status: Backport from upstream [http://repo.or.cz/nasm.git] |
| 17 | CVE: CVE-2018-10316 |
| 18 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> |
| 19 | --- |
| 20 | asm/nasm.c | 7 ++++++- |
| 21 | 1 file changed, 6 insertions(+), 1 deletion(-) |
| 22 | |
| 23 | diff --git a/asm/nasm.c b/asm/nasm.c |
| 24 | index 8497ec9..81f6cee 100644 |
| 25 | --- a/asm/nasm.c |
| 26 | +++ b/asm/nasm.c |
| 27 | @@ -99,6 +99,8 @@ static char outname[FILENAME_MAX]; |
| 28 | static char listname[FILENAME_MAX]; |
| 29 | static char errname[FILENAME_MAX]; |
| 30 | static int globallineno; /* for forward-reference tracking */ |
| 31 | +#define GLOBALLINENO_MAX INT32_MAX |
| 32 | + |
| 33 | /* static int pass = 0; */ |
| 34 | const struct ofmt *ofmt = &OF_DEFAULT; |
| 35 | const struct ofmt_alias *ofmt_alias = NULL; |
| 36 | @@ -1360,7 +1362,10 @@ static void assemble_file(char *fname, StrList **depend_ptr) |
| 37 | location.offset = offs = get_curr_offs(); |
| 38 | |
| 39 | while ((line = preproc->getline())) { |
| 40 | - globallineno++; |
| 41 | + if (globallineno++ == GLOBALLINENO_MAX) |
| 42 | + nasm_error(ERR_FATAL, |
| 43 | + "overall line number reaches the maximum %d\n", |
| 44 | + GLOBALLINENO_MAX); |
| 45 | |
| 46 | /* |
| 47 | * Here we parse our directives; this is not handled by the |
| 48 | -- |
| 49 | 2.7.4 |
| 50 | |