Attachment 625851 Details for Bug 720644 – Fix refusing big numbers

[patch] Fix refusing big numbers

perl-5.10.1-Do-not-wrap-count-argument-of-Perl_repeatcpy.patch (text/plain), 1.07 KB, created by Petr Pisar on 2012-10-12 08:28:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Pisar

Created: 2012-10-12 08:28:00 UTC

Size: 1.07 KB

patch

obsolete

>From 5eea3d5b46c00ca84bf45b3e5438343feb0ffe30 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
>Date: Tue, 9 Oct 2012 18:18:08 +0200
>Subject: [PATCH] Do not wrap count argument of Perl_repeatcpy()
>
>This fixes CVE-2012-5195.
>See <https://bugzilla.redhat.com/show_bug.cgi?id=862413>.
>---
> pp.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/pp.c b/pp.c
>index 40e512a..28bbfe8 100644
>--- a/pp.c
>+++ b/pp.c
>@@ -1553,6 +1553,9 @@ PP(pp_repeat)
> 		SP--;
> 	    }
> 	    MARK++;
>+	    if (count - 1 > I32_MAX) {
>+		Perl_croak_nocontext("%s", PL_memory_wrap);
>+	    }
> 	    repeatcpy((char*)(MARK + items), (char*)MARK,
> 		items * sizeof(const SV *), count - 1);
> 	    SP += max;
>@@ -1579,6 +1582,9 @@ PP(pp_repeat)
> 		     Perl_croak(aTHX_ oom_string_extend);
> 	        MEM_WRAP_CHECK_1(max, char, oom_string_extend);
> 		SvGROW(TARG, max + 1);
>+		if (count - 1 > I32_MAX) {
>+		    Perl_croak_nocontext("%s", PL_memory_wrap);
>+		}
> 		repeatcpy(SvPVX(TARG) + len, SvPVX(TARG), len, count - 1);
> 		SvCUR_set(TARG, SvCUR(TARG) * count);
> 	    }
>-- 
>1.7.11.7
>

Actions: View | Diff

Attachments on bug 720644: 625851 | 657636