diff options
| author | Andreas Schwab <schwab@suse.de> | 2018-05-24 14:39:18 +0200 |
|---|---|---|
| committer | Fangrui Song <i@maskray.me> | 2021-08-27 16:22:13 -0700 |
| commit | c4fde9669a5782479c1d6bd964b6339b5130b7e2 (patch) | |
| tree | edd8dca3bce8a748c74bb7a94d2386597244e08b /ChangeLog | |
| parent | da768de04f2cdbf6117bddb7a23593d6fb4356fb (diff) | |
| download | glibc-c4fde9669a5782479c1d6bd964b6339b5130b7e2.zip glibc-c4fde9669a5782479c1d6bd964b6339b5130b7e2.tar.gz glibc-c4fde9669a5782479c1d6bd964b6339b5130b7e2.tar.bz2 | |
Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
When compiled as mempcpy, the return value is the end of the destination
buffer, thus it cannot be used to refer to the start of it.
(cherry picked from commit 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e)
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -1,3 +1,12 @@ +2018-05-23 Andreas Schwab <schwab@suse.de> + + [BZ #23196] + CVE-2018-11237 + * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S + (L(preloop_large)): Save initial destination pointer in %r11 and + use it instead of %rax after the loop. + * string/test-mempcpy.c (MIN_PAGE_SIZE): Define. + 2018-05-11 Florian Weimer <fweimer@redhat.com> [BZ #23166] |