[PATCH] arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
authorEvgeny Eremin <e.eremin@omprussia.ru>
Wed, 8 Jul 2020 12:18:19 +0000 (14:18 +0200)
committerAdrian Bunk <bunk@debian.org>
Sat, 29 Jun 2024 10:27:34 +0000 (13:27 +0300)
commit068066b7aa1e78f7322b4296d36d4cd858b36bdd
treefd1da95e3195b634b59b3430c4f4a9faa48f3aa9
parentb83c26d29f4736eaeaf57707edbc84728aba55bc
[PATCH] arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]

Unsigned branch instructions could be used for r2 to fix the wrong
behavior when a negative length is passed to memcpy and memmove.
This commit fixes the generic arm implementation of memcpy amd memmove.

From beea361050728138b82c57dda0c4810402d342b9 Mon Sep 17 00:00:00 2001
From: Alexander Anisimov <a.anisimov@omprussia.ru>
Date: Wed, 8 Jul 2020 14:18:31 +0200
Subject: [PATCH] arm: CVE-2020-6096: Fix multiarch memcpy for negative length
 [BZ #25620]

Unsigned branch instructions could be used for r2 to fix the wrong
behavior when a negative length is passed to memcpy.
This commit fixes the armv7 version.

From eec0f4218cda936a6ab8f543e90b96b196df3fc2 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Tue, 12 May 2020 19:02:08 +0200
Subject: [PATCH] string: Add string/tst-memmove-overflow, a test case for bug
 25620

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
From 0e28cfff9dfdb71352151054e0d38816856182d5 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Tue, 12 May 2020 19:01:49 +0200
Subject: [PATCH] support: Add support_blob_repeat_allocate_shared

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Gbp-Pq: Topic arm
Gbp-Pq: Name git-CVE-2020-6096-fix-memcpy-and-memmove-for-negative-size.diff
string/Makefile
string/tst-memmove-overflow.c [new file with mode: 0644]
support/blob_repeat.c
support/blob_repeat.h
support/tst-support_blob_repeat.c
sysdeps/arm/armv7/multiarch/memcpy_impl.S
sysdeps/arm/memcpy.S
sysdeps/arm/memmove.S