Remove CVE-2015-2305.patch. Already fixed upstream in a different

way
This commit is contained in:
Sylvestre Ledru 2015-08-28 12:22:58 +00:00
parent 50641c5803
commit ac07cf4fdf
3 changed files with 7 additions and 36 deletions

7
debian/changelog vendored
View File

@ -1,3 +1,10 @@
llvm-toolchain-3.7 (1:3.7-2) UNRELEASED; urgency=medium
* Remove CVE-2015-2305.patch. Already fixed upstream in a different
way
-- Sylvestre Ledru <sylvestre@debian.org> Fri, 28 Aug 2015 14:22:33 +0200
llvm-toolchain-3.7 (1:3.7-1) unstable; urgency=medium
* New upstream release

View File

@ -1,35 +0,0 @@
Description: Taken from http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c
--- llvm-toolchain-3.5-3.5.2.orig/lib/Support/regcomp.c
+++ llvm-toolchain-3.5-3.5.2/lib/Support/regcomp.c
@@ -169,6 +169,7 @@ llvm_regcomp(llvm_regex_t *preg, const c
struct parse *p = &pa;
int i;
size_t len;
+ size_t maxlen;
#ifdef REDEBUG
# define GOODFLAGS(f) (f)
#else
@@ -191,7 +192,23 @@ llvm_regcomp(llvm_regex_t *preg, const c
(NC-1)*sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
+ /*
+ * Limit the pattern space to avoid a 32-bit overflow on buffer
+ * extension. Also avoid any signed overflow in case of conversion
+ * so make the real limit based on a 31-bit overflow.
+ *
+ * Likely not applicable on 64-bit systems but handle the case
+ * generically (who are we to stop people from using ~715MB+
+ * patterns?).
+ */
+ maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
+ if (len >= maxlen) {
+ free((char *)g);
+ return(REG_ESPACE);
+ }
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+ assert(p->ssize >= len);
+
p->strip = (sop *)calloc(p->ssize, sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {

View File

@ -40,7 +40,6 @@ compiler-rt-i586.diff
clang-analyzer-force-version.diff
#bug783205.patch
locale-issue-ld.diff
CVE-2015-2305.patch
bug783205.patch
fix-cmake-config-prefix.diff
kfreebsd-build-fix.patch