diff options
Diffstat (limited to 'boost/boost-1.74-CVE-2012-2677.patch')
| -rw-r--r-- | boost/boost-1.74-CVE-2012-2677.patch | 125 |
1 files changed, 0 insertions, 125 deletions
diff --git a/boost/boost-1.74-CVE-2012-2677.patch b/boost/boost-1.74-CVE-2012-2677.patch deleted file mode 100644 index ff947f7..0000000 --- a/boost/boost-1.74-CVE-2012-2677.patch +++ /dev/null | |||
| @@ -1,125 +0,0 @@ | |||
| 1 | https://src.fedoraproject.org/rpms/boost/raw/master/f/boost-1.58.0-pool.patch | ||
| 2 | https://bugzilla.redhat.com/show_bug.cgi?id=828856 | ||
| 3 | https://bugs.gentoo.org/620468 | ||
| 4 | https://svn.boost.org/trac10/ticket/6701 | ||
| 5 | |||
| 6 | Index: boost/pool/pool.hpp | ||
| 7 | =================================================================== | ||
| 8 | --- a/boost/pool/pool.hpp (revision 78317) | ||
| 9 | +++ b/boost/pool/pool.hpp (revision 78326) | ||
| 10 | @@ -27,4 +27,6 @@ | ||
| 11 | #include <boost/pool/poolfwd.hpp> | ||
| 12 | |||
| 13 | +// std::numeric_limits | ||
| 14 | +#include <boost/limits.hpp> | ||
| 15 | // boost::integer::static_lcm | ||
| 16 | #include <boost/integer/common_factor_ct.hpp> | ||
| 17 | @@ -358,4 +360,11 @@ | ||
| 18 | } | ||
| 19 | |||
| 20 | + size_type max_chunks() const | ||
| 21 | + { //! Calculated maximum number of memory chunks that can be allocated in a single call by this Pool. | ||
| 22 | + size_type partition_size = alloc_size(); | ||
| 23 | + size_type POD_size = integer::static_lcm<sizeof(size_type), sizeof(void *)>::value + sizeof(size_type); | ||
| 24 | + return (std::numeric_limits<size_type>::max() - POD_size) / alloc_size(); | ||
| 25 | + } | ||
| 26 | + | ||
| 27 | static void * & nextof(void * const ptr) | ||
| 28 | { //! \returns Pointer dereferenced. | ||
| 29 | @@ -377,5 +388,7 @@ | ||
| 30 | //! the first time that object needs to allocate system memory. | ||
| 31 | //! The default is 32. This parameter may not be 0. | ||
| 32 | - //! \param nmax_size is the maximum number of chunks to allocate in one block. | ||
| 33 | + //! \param nmax_size is the maximum number of chunks to allocate in one block. | ||
| 34 | + set_next_size(nnext_size); | ||
| 35 | + set_max_size(nmax_size); | ||
| 36 | } | ||
| 37 | |||
| 38 | @@ -400,7 +413,7 @@ | ||
| 39 | } | ||
| 40 | void set_next_size(const size_type nnext_size) | ||
| 41 | - { //! Set number of chunks to request from the system the next time that object needs to allocate system memory. This value should never be set to 0. | ||
| 42 | - //! \returns nnext_size. | ||
| 43 | - next_size = start_size = nnext_size; | ||
| 44 | + { //! Set number of chunks to request from the system the next time that object needs to allocate system memory. This value should never be set to 0. | ||
| 45 | + BOOST_USING_STD_MIN(); | ||
| 46 | + next_size = start_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nnext_size, max_chunks()); | ||
| 47 | } | ||
| 48 | size_type get_max_size() const | ||
| 49 | @@ -410,5 +423,6 @@ | ||
| 50 | void set_max_size(const size_type nmax_size) | ||
| 51 | { //! Set max_size. | ||
| 52 | - max_size = nmax_size; | ||
| 53 | + BOOST_USING_STD_MIN(); | ||
| 54 | + max_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nmax_size, max_chunks()); | ||
| 55 | } | ||
| 56 | size_type get_requested_size() const | ||
| 57 | @@ -713,7 +727,7 @@ | ||
| 58 | BOOST_USING_STD_MIN(); | ||
| 59 | if(!max_size) | ||
| 60 | - next_size <<= 1; | ||
| 61 | + set_next_size(next_size << 1); | ||
| 62 | else if( next_size*partition_size/requested_size < max_size) | ||
| 63 | - next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); | ||
| 64 | + set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); | ||
| 65 | |||
| 66 | // initialize it, | ||
| 67 | @@ -753,7 +767,7 @@ | ||
| 68 | BOOST_USING_STD_MIN(); | ||
| 69 | if(!max_size) | ||
| 70 | - next_size <<= 1; | ||
| 71 | + set_next_size(next_size << 1); | ||
| 72 | else if( next_size*partition_size/requested_size < max_size) | ||
| 73 | - next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); | ||
| 74 | + set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); | ||
| 75 | |||
| 76 | // initialize it, | ||
| 77 | @@ -797,4 +811,6 @@ | ||
| 78 | //! \returns Address of chunk n if allocated ok. | ||
| 79 | //! \returns 0 if not enough memory for n chunks. | ||
| 80 | + if (n > max_chunks()) | ||
| 81 | + return 0; | ||
| 82 | |||
| 83 | const size_type partition_size = alloc_size(); | ||
| 84 | @@ -845,7 +861,7 @@ | ||
| 85 | BOOST_USING_STD_MIN(); | ||
| 86 | if(!max_size) | ||
| 87 | - next_size <<= 1; | ||
| 88 | + set_next_size(next_size << 1); | ||
| 89 | else if( next_size*partition_size/requested_size < max_size) | ||
| 90 | - next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size); | ||
| 91 | + set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size)); | ||
| 92 | |||
| 93 | // insert it into the list, | ||
| 94 | Index: libs/pool/test/test_bug_6701.cpp | ||
| 95 | =================================================================== | ||
| 96 | --- a/libs/pool/test/test_bug_6701.cpp (revision 78326) | ||
| 97 | +++ b/libs/pool/test/test_bug_6701.cpp (revision 78326) | ||
| 98 | @@ -0,0 +1,27 @@ | ||
| 99 | +/* Copyright (C) 2012 Étienne Dupuis | ||
| 100 | +* | ||
| 101 | +* Use, modification and distribution is subject to the | ||
| 102 | +* Boost Software License, Version 1.0. (See accompanying | ||
| 103 | +* file LICENSE_1_0.txt or http://www.boost.org/LICENSE_1_0.txt) | ||
| 104 | +*/ | ||
| 105 | + | ||
| 106 | +// Test of bug #6701 (https://svn.boost.org/trac/boost/ticket/6701) | ||
| 107 | + | ||
| 108 | +#include <boost/pool/object_pool.hpp> | ||
| 109 | +#include <boost/limits.hpp> | ||
| 110 | + | ||
| 111 | +int main() | ||
| 112 | +{ | ||
| 113 | + boost::pool<> p(1024, std::numeric_limits<size_t>::max() / 768); | ||
| 114 | + | ||
| 115 | + void *x = p.malloc(); | ||
| 116 | + BOOST_ASSERT(!x); | ||
| 117 | + | ||
| 118 | + BOOST_ASSERT(std::numeric_limits<size_t>::max() / 1024 >= p.get_next_size()); | ||
| 119 | + BOOST_ASSERT(std::numeric_limits<size_t>::max() / 1024 >= p.get_max_size()); | ||
| 120 | + | ||
| 121 | + void *y = p.ordered_malloc(std::numeric_limits<size_t>::max() / 768); | ||
| 122 | + BOOST_ASSERT(!y); | ||
| 123 | + | ||
| 124 | + return 0; | ||
| 125 | +} | ||
