Fix CVE-2015-2305

debian/changelog

@@ -2,6 +2,7 @@ llvm-toolchain-3.7 (1:3.7~+rc2-3) UNRELEASED; urgency=medium
 
   * Fix VCS fields.
   * d/p/bug783205.patch rebase s390x patch to apply to 3.7
+  * d/p/CVE-2015-2305.patch, fix security issue on regcomp.c
 
  -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 13 Aug 2015 09:02:30 +0200
 

debian/patches/CVE-2015-2305.patch

@@ -0,0 +1,35 @@
+Description: Taken from http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c
+--- llvm-toolchain-3.5-3.5.2.orig/lib/Support/regcomp.c
++++ llvm-toolchain-3.5-3.5.2/lib/Support/regcomp.c
+@@ -169,6 +169,7 @@ llvm_regcomp(llvm_regex_t *preg, const c
+ 	struct parse *p = &pa;
+ 	int i;
+ 	size_t len;
++	size_t maxlen;
+ #ifdef REDEBUG
+ #	define	GOODFLAGS(f)	(f)
+ #else
+@@ -191,7 +192,23 @@ llvm_regcomp(llvm_regex_t *preg, const c
+ 							(NC-1)*sizeof(cat_t));
+ 	if (g == NULL)
+ 		return(REG_ESPACE);
++	 /*
++	 * Limit the pattern space to avoid a 32-bit overflow on buffer
++	 * extension.  Also avoid any signed overflow in case of conversion
++	 * so make the real limit based on a 31-bit overflow.
++	 *
++	 * Likely not applicable on 64-bit systems but handle the case
++	 * generically (who are we to stop people from using ~715MB+
++	 * patterns?).
++	 */
++	maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
++	if (len >= maxlen) {
++		free((char *)g);
++		return(REG_ESPACE);
++	}
+ 	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
++	assert(p->ssize >= len);
++
+ 	p->strip = (sop *)calloc(p->ssize, sizeof(sop));
+ 	p->slen = 0;
+ 	if (p->strip == NULL) {

debian/patches/series

@@ -41,3 +41,4 @@ clang-analyzer-force-version.diff
 
 locale-issue-ld.diff
 bug783205.patch
+CVE-2015-2305.patch