[gentoo-commits] gentoo-x86 commit in dev-util/byacc/files: byacc-1.9-CVE-2008-3196.patch

[Robert Buchholz (rbu)]

rbu         08/10/04 18:57:32

  Added:                byacc-1.9-CVE-2008-3196.patch
  Log:
  Fix stack access error (security bug #232005).
  (Portage version: 2.2_rc11/cvs/Linux 2.6.25-gentoo-r6 x86_64)

Revision  Changes    Path
1.1                  dev-util/byacc/files/byacc-1.9-CVE-2008-3196.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-util/byacc/files/byacc-1.9-CVE-2008-3196.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/dev-util/byacc/files/byacc-1.9-CVE-2008-3196.patch?rev=1.1&content-type=text/plain

Index: byacc-1.9-CVE-2008-3196.patch
===================================================================
Tue Jul 8 15:06:50 2008 UTC by otto

Fix an venerable bug: if we're reducing a rule that has an empty
right hand side and the yacc stackpointer is pointing at the very
end of the allocated stack, we end up accessing the stack out of
bounds by the implicit $$ = $1 action.  Detected by my new malloc,
experienced by sturm@ on sparc64; ok deraadt@


Index: yacc-1.9.1/skeleton.c
===================================================================
--- yacc-1.9.1.orig/skeleton.c
+++ yacc-1.9.1/skeleton.c
@@ -18,6 +18,7 @@ char *banner[] =
     "/*static char yysccsid[] = \"from: @(#)yaccpar	1.9 (Berkeley) 02/21/93\";*/",
     "static char yyrcsid[] = \"$Id: byacc-1.9-CVE-2008-3196.patch,v 1.1 2008/10/04 18:57:31 rbu Exp $\";",
     "#endif",
+    "#include <string.h>",
     "#define YYBYACC 1",
     "#define YYMAJOR 1",
     "#define YYMINOR 9",
@@ -226,7 +227,10 @@ char *body[] =
     "                YYPREFIX, yystate, yyn, yyrule[yyn]);",
     "#endif",
     "    yym = yylen[yyn];",
-    "    yyval = yyvsp[1-yym];",
+    "    if (yym)",
+    "        yyval = yyvsp[1-yym];",
+    "    else",
+    "        memset(&yyval, 0, sizeof yyval);",
     "    switch (yyn)",
     "    {",
     0