From 8a67a4b3435d8471523d3ae4f7cb46cf9b8d72d9 Mon Sep 17 00:00:00 2001 From: Andreas Jaeger Date: Fri, 10 May 2013 20:28:40 +0200 Subject: Fix integer overflow in sysdeps/unix/sysv/linux/bits/sched.h [BZ #15448] * sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S) (__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow. --- ChangeLog | 6 ++++++ NEWS | 3 ++- sysdeps/unix/sysv/linux/bits/sched.h | 6 +++--- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index a7e4b253d1..4226597f7b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2013-05-10 Andreas Jaeger + + [BZ #15448] + * sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S) + (__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow. + 2013-05-10 Joseph Myers * math/gen-libm-test.pl (adjust_arg): New function. diff --git a/NEWS b/NEWS index 87d9128700..5c005bc2bf 100644 --- a/NEWS +++ b/NEWS @@ -16,7 +16,8 @@ Version 2.18 15055, 15062, 15078, 15084, 15085, 15086, 15160, 15214, 15221, 15232, 15234, 15283, 15285, 15287, 15304, 15305, 15307, 15309, 15327, 15330, 15335, 15336, 15337, 15342, 15346, 15359, 15361, 15366, 15380, 15394, - 15395, 15405, 15406, 15409, 15416, 15418, 15419, 15423, 15426, 15429. + 15395, 15405, 15406, 15409, 15416, 15418, 15419, 15423, 15426, 15429, + 15448. * CVE-2013-0242 Buffer overrun in regexp matcher has been fixed (Bugzilla #15078). diff --git a/sysdeps/unix/sysv/linux/bits/sched.h b/sysdeps/unix/sysv/linux/bits/sched.h index 5e8057b62e..e42dee8e62 100644 --- a/sysdeps/unix/sysv/linux/bits/sched.h +++ b/sysdeps/unix/sysv/linux/bits/sched.h @@ -144,21 +144,21 @@ typedef struct # define __CPU_SET_S(cpu, setsize, cpusetp) \ (__extension__ \ ({ size_t __cpu = (cpu); \ - __cpu < 8 * (setsize) \ + __cpu / 8 < (setsize) \ ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)] \ |= __CPUMASK (__cpu)) \ : 0; })) # define __CPU_CLR_S(cpu, setsize, cpusetp) \ (__extension__ \ ({ size_t __cpu = (cpu); \ - __cpu < 8 * (setsize) \ + __cpu / 8 < (setsize) \ ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)] \ &= ~__CPUMASK (__cpu)) \ : 0; })) # define __CPU_ISSET_S(cpu, setsize, cpusetp) \ (__extension__ \ ({ size_t __cpu = (cpu); \ - __cpu < 8 * (setsize) \ + __cpu / 8 < (setsize) \ ? ((((const __cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)] \ & __CPUMASK (__cpu))) != 0 \ : 0; })) -- cgit 1.4.1