File CVE-2016-9427.patch of Package gc

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-9427.patch of Package gc (Revision 882dfca034bc0a2c4760ae53c00300b8)

Currently displaying revision 882dfca034bc0a2c4760ae53c00300b8 , Show latest

Index: gc-7.2/allchblk.c
===================================================================
--- gc-7.2.orig/allchblk.c
+++ gc-7.2/allchblk.c
@@ -594,7 +594,7 @@ GC_allochblk(size_t sz, int kind, unsign
                      /* split.                                          */
 
     GC_ASSERT((sz & (GRANULE_BYTES - 1)) == 0);
-    blocks = OBJ_SZ_TO_BLOCKS(sz);
+    blocks = OBJ_SZ_TO_BLOCKS_CHECKED(sz);
     if ((signed_word)(blocks * HBLKSIZE) < 0) {
       return 0;
     }
@@ -661,7 +661,7 @@ GC_allochblk_nth(size_t sz, int kind, un
     signed_word size_needed;    /* number of bytes in requested objects */
     signed_word size_avail;     /* bytes available in this block        */
 
-    size_needed = HBLKSIZE * OBJ_SZ_TO_BLOCKS(sz);
+    size_needed = HBLKSIZE * OBJ_SZ_TO_BLOCKS_CHECKED(sz);
 
     /* search for a big enough block in free list */
         hbp = GC_hblkfreelist[n];
Index: gc-7.2/alloc.c
===================================================================
--- gc-7.2.orig/alloc.c
+++ gc-7.2/alloc.c
@@ -1138,13 +1138,13 @@ GC_word GC_max_retries = 0;
  */
 GC_INNER GC_bool GC_expand_hp_inner(word n)
 {
-    word bytes;
+    size_t bytes;
     struct hblk * space;
     word expansion_slop;        /* Number of bytes by which we expect the */
                                 /* heap to expand soon.                   */
 
     if (n < MINHINCR) n = MINHINCR;
-    bytes = n * HBLKSIZE;
+    bytes = (size_t)n * HBLKSIZE;
     /* Make sure bytes is a multiple of GC_page_size */
       {
         word mask = GC_page_size - 1;
@@ -1152,7 +1152,9 @@ GC_INNER GC_bool GC_expand_hp_inner(word
         bytes &= ~mask;
       }
 
-    if (GC_max_heapsize != 0 && GC_heapsize + bytes > GC_max_heapsize) {
+    if (GC_max_heapsize != 0
+        && (GC_max_heapsize < (word)bytes
+            || GC_heapsize > GC_max_heapsize - (word)bytes)) {
         /* Exceeded self-imposed limit */
         return(FALSE);
     }
@@ -1176,7 +1178,7 @@ GC_INNER GC_bool GC_expand_hp_inner(word
     if ((GC_last_heap_addr == 0 && !((word)space & SIGNB))
         || (GC_last_heap_addr != 0 && GC_last_heap_addr < (ptr_t)space)) {
         /* Assume the heap is growing up */
-        word new_limit = (word)space + bytes + expansion_slop;
+        word new_limit = (word)space + (word)bytes + expansion_slop;
         if (new_limit > (word)space) {
           GC_greatest_plausible_heap_addr =
             (void *)GC_max((word)GC_greatest_plausible_heap_addr,
@@ -1221,6 +1223,8 @@ GC_INNER unsigned GC_fail_count = 0;
                         /* How many consecutive GC/expansion failures?  */
                         /* Reset by GC_allochblk.                       */
 
+#define GC_WORD_MAX (~(word)0)
+
 /* Collect or expand heap in an attempt make the indicated number of    */
 /* free blocks available.  Should be called until the blocks are        */
 /* available (seting retry value to TRUE unless this is the first call  */
@@ -1269,6 +1273,8 @@ GC_INNER GC_bool GC_collect_or_expand(wo
       } else {
         blocks_to_get = MAXHINCR;
       }
+      if (blocks_to_get > divHBLKSZ(GC_WORD_MAX))
+        blocks_to_get = divHBLKSZ(GC_WORD_MAX);
     }
 
     if (!GC_expand_hp_inner(blocks_to_get)
Index: gc-7.2/dbg_mlc.c
===================================================================
--- gc-7.2.orig/dbg_mlc.c
+++ gc-7.2/dbg_mlc.c
@@ -461,7 +461,7 @@ GC_API void * GC_CALL GC_debug_malloc(si
     /* Note that according to malloc() specification, if size is 0 then */
     /* malloc() returns either NULL, or a unique pointer value that can */
     /* later be successfully passed to free(). We always do the latter. */
-    result = GC_malloc(lb + DEBUG_BYTES);
+    result = GC_malloc(SIZET_SAT_ADD(lb, DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc(%lu) returning NULL (",
@@ -480,7 +480,7 @@ GC_API void * GC_CALL GC_debug_malloc(si
 GC_API void * GC_CALL GC_debug_malloc_ignore_off_page(size_t lb,
                                                       GC_EXTRA_PARAMS)
 {
-    void * result = GC_malloc_ignore_off_page(lb + DEBUG_BYTES);
+    void * result = GC_malloc_ignore_off_page(SIZET_SAT_ADD(lb, DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc_ignore_off_page(%lu) returning NULL (",
@@ -499,7 +499,8 @@ GC_API void * GC_CALL GC_debug_malloc_ig
 GC_API void * GC_CALL GC_debug_malloc_atomic_ignore_off_page(size_t lb,
                                                              GC_EXTRA_PARAMS)
 {
-    void * result = GC_malloc_atomic_ignore_off_page(lb + DEBUG_BYTES);
+    void * result = GC_malloc_atomic_ignore_off_page(
+                                SIZET_SAT_ADD(lb, DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc_atomic_ignore_off_page(%lu)"
@@ -523,7 +524,8 @@ GC_API void * GC_CALL GC_debug_malloc_at
   /* we already hold the GC lock.                                       */
   GC_INNER void * GC_debug_generic_malloc_inner(size_t lb, int k)
   {
-    void * result = GC_generic_malloc_inner(lb + DEBUG_BYTES, k);
+    void * result = GC_generic_malloc_inner(
+                                SIZET_SAT_ADD(lb, DEBUG_BYTES), k);
 
     if (result == 0) {
         GC_err_printf("GC internal allocation (%lu bytes) returning NULL\n",
@@ -538,7 +540,7 @@ GC_API void * GC_CALL GC_debug_malloc_at
                                                                 int k)
   {
     void * result = GC_generic_malloc_inner_ignore_off_page(
-                                                lb + DEBUG_BYTES, k);
+                                SIZET_SAT_ADD(lb, DEBUG_BYTES), k);
 
     if (result == 0) {
         GC_err_printf("GC internal allocation (%lu bytes) returning NULL\n",
@@ -553,7 +555,7 @@ GC_API void * GC_CALL GC_debug_malloc_at
 #ifdef STUBBORN_ALLOC
   GC_API void * GC_CALL GC_debug_malloc_stubborn(size_t lb, GC_EXTRA_PARAMS)
   {
-    void * result = GC_malloc_stubborn(lb + DEBUG_BYTES);
+    void * result = GC_malloc_stubborn(SIZET_SAT_ADD(lb, DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc(%lu) returning NULL (",
@@ -619,7 +621,7 @@ GC_API void * GC_CALL GC_debug_malloc_at
 
 GC_API void * GC_CALL GC_debug_malloc_atomic(size_t lb, GC_EXTRA_PARAMS)
 {
-    void * result = GC_malloc_atomic(lb + DEBUG_BYTES);
+    void * result = GC_malloc_atomic(SIZET_SAT_ADD(lb, DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc_atomic(%lu) returning NULL (",
@@ -702,7 +704,8 @@ GC_API char * GC_CALL GC_debug_strndup(c
 GC_API void * GC_CALL GC_debug_malloc_uncollectable(size_t lb,
                                                     GC_EXTRA_PARAMS)
 {
-    void * result = GC_malloc_uncollectable(lb + UNCOLLECTABLE_DEBUG_BYTES);
+    void * result = GC_malloc_uncollectable(
+                                SIZET_SAT_ADD(lb, UNCOLLECTABLE_DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf("GC_debug_malloc_uncollectable(%lu) returning NULL (",
@@ -722,8 +725,8 @@ GC_API void * GC_CALL GC_debug_malloc_un
   GC_API void * GC_CALL GC_debug_malloc_atomic_uncollectable(size_t lb,
                                                              GC_EXTRA_PARAMS)
   {
-    void * result =
-        GC_malloc_atomic_uncollectable(lb + UNCOLLECTABLE_DEBUG_BYTES);
+    void * result = GC_malloc_atomic_uncollectable(
+                                SIZET_SAT_ADD(lb, UNCOLLECTABLE_DEBUG_BYTES));
 
     if (result == 0) {
         GC_err_printf(
Index: gc-7.2/gcj_mlc.c
===================================================================
--- gc-7.2.orig/gcj_mlc.c
+++ gc-7.2/gcj_mlc.c
@@ -216,7 +216,8 @@ GC_API void * GC_CALL GC_debug_gcj_mallo
     /* confuse the backtrace.                                   */
     LOCK();
     maybe_finalize();
-    result = GC_generic_malloc_inner(lb + DEBUG_BYTES, GC_gcj_debug_kind);
+    result = GC_generic_malloc_inner(SIZET_SAT_ADD(lb, DEBUG_BYTES),
+                                     GC_gcj_debug_kind);
     if (result == 0) {
         GC_oom_func oom_fn = GC_oom_fn;
         UNLOCK();
Index: gc-7.2/headers.c
===================================================================
--- gc-7.2.orig/headers.c
+++ gc-7.2/headers.c
@@ -126,7 +126,7 @@ GC_INNER ptr_t GC_scratch_alloc(size_t b
         return(result);
     }
     {
-        word bytes_to_get = MINHINCR * HBLKSIZE;
+        size_t bytes_to_get = MINHINCR * HBLKSIZE;
 
         if (bytes_to_get <= bytes) {
           /* Undo the damage, and get memory directly */
Index: gc-7.2/include/private/gc_priv.h
===================================================================
--- gc-7.2.orig/include/private/gc_priv.h
+++ gc-7.2/include/private/gc_priv.h
@@ -90,6 +90,20 @@ typedef char * ptr_t;   /* A generic poi
                         /* byte displacements and which can be used     */
                         /* for address comparisons.                     */
 
+#ifndef SIZE_MAX
+# include <limits.h>
+#endif
+#ifdef SIZE_MAX
+# define GC_SIZE_MAX SIZE_MAX
+#else
+# define GC_SIZE_MAX (~(size_t)0)
+#endif
+
+/* Saturated addition of size_t values.  Used to avoid value wrap       */
+/* around on overflow.  The arguments should have no side effects.      */
+#define SIZET_SAT_ADD(a, b) \
+                ((a) < GC_SIZE_MAX - (b) ? (a) + (b) : GC_SIZE_MAX)
+
 #ifndef GCCONFIG_H
 # include "gcconfig.h"
 #endif
@@ -245,9 +259,9 @@ typedef char * ptr_t;   /* A generic poi
 # ifdef LINT2
     /* Explicitly instruct the code analysis tool that                  */
     /* GC_all_interior_pointers is assumed to have only 0 or 1 value.   */
-#   define EXTRA_BYTES (GC_all_interior_pointers? 1 : 0)
+#   define EXTRA_BYTES ((size_t)(GC_all_interior_pointers? 1 : 0))
 # else
-#   define EXTRA_BYTES GC_all_interior_pointers
+#   define EXTRA_BYTES (size_t)GC_all_interior_pointers
 # endif
 # define MAX_EXTRA_BYTES 1
 #else
@@ -655,6 +669,7 @@ GC_EXTERN GC_warn_proc GC_current_warn_p
 # define LOG_HBLKSIZE   ((size_t)CPP_LOG_HBLKSIZE)
 # define HBLKSIZE ((size_t)CPP_HBLKSIZE)
 
+#define GC_SQRT_SIZE_MAX ((((size_t)1) << (WORDSZ / 2)) - 1)
 
 /*  max size objects supported by freelist (larger objects are  */
 /*  allocated directly with allchblk(), by rounding to the next */
@@ -684,8 +699,8 @@ GC_EXTERN GC_warn_proc GC_current_warn_p
 # define HBLKDISPL(objptr) (((size_t) (objptr)) & (HBLKSIZE-1))
 
 /* Round up byte allocation requests to integral number of words, etc. */
-# define ROUNDED_UP_GRANULES(n) \
-        BYTES_TO_GRANULES((n) + (GRANULE_BYTES - 1 + EXTRA_BYTES))
+# define ROUNDED_UP_GRANULES(lb) /* lb should have no side-effect */ \
+        BYTES_TO_GRANULES(SIZET_SAT_ADD(lb, GRANULE_BYTES - 1 + EXTRA_BYTES))
 # if MAX_EXTRA_BYTES == 0
 #  define SMALL_OBJ(bytes) EXPECT((bytes) <= (MAXOBJBYTES), TRUE)
 # else
@@ -695,7 +710,8 @@ GC_EXTERN GC_warn_proc GC_current_warn_p
         /* This really just tests bytes <= MAXOBJBYTES - EXTRA_BYTES.   */
         /* But we try to avoid looking up EXTRA_BYTES.                  */
 # endif
-# define ADD_SLOP(bytes) ((bytes) + EXTRA_BYTES)
+# define ADD_SLOP(lb) /* lb should have no side-effect */ \
+                SIZET_SAT_ADD(lb, EXTRA_BYTES)
 # ifndef MIN_WORDS
 #  define MIN_WORDS 2   /* FIXME: obsolete */
 # endif
@@ -892,9 +908,11 @@ struct hblk {
 
 # define HBLK_IS_FREE(hdr) (((hdr) -> hb_flags & FREE_BLK) != 0)
 
-# define OBJ_SZ_TO_BLOCKS(sz) divHBLKSZ((sz) + HBLKSIZE-1)
+# define OBJ_SZ_TO_BLOCKS(lb) divHBLKSZ((lb) + HBLKSIZE-1)
+# define OBJ_SZ_TO_BLOCKS_CHECKED(lb) /* lb should have no side-effect */ \
+                                divHBLKSZ(SIZET_SAT_ADD(lb, HBLKSIZE - 1))
     /* Size of block (in units of HBLKSIZE) needed to hold objects of   */
-    /* given sz (in bytes).                                             */
+    /* given lb (in bytes).  The checked variant prevents wrap around.  */
 
 /* Object free list link */
 # define obj_link(p) (*(void  **)(p))
@@ -1262,7 +1280,7 @@ GC_EXTERN word GC_n_heap_sects; /* Numbe
                                 /* sections.                            */
 #endif
 
-GC_EXTERN word GC_page_size;
+GC_EXTERN size_t GC_page_size;
 
 #if defined(MSWIN32) || defined(MSWINCE) || defined(CYGWIN32)
   struct _SYSTEM_INFO;
Index: gc-7.2/include/private/gcconfig.h
===================================================================
--- gc-7.2.orig/include/private/gcconfig.h
+++ gc-7.2/include/private/gcconfig.h
@@ -2779,7 +2779,8 @@
         /* usually makes it possible to merge consecutively allocated   */
         /* chunks.  It also avoids unintended recursion with            */
         /* REDIRECT_MALLOC macro defined.                               */
-        /* GET_MEM() returns a HLKSIZE aligned chunk.                   */
+        /* GET_MEM() argument should be of size_t type and have         */
+        /* no side-effect.  GET_MEM() returns HLKSIZE-aligned chunk;    */
         /* 0 is taken to mean failure.                                  */
         /* In the case os USE_MMAP, the argument must also be a         */
         /* physical page size.                                          */
@@ -2789,45 +2790,52 @@
         struct hblk;    /* See gc_priv.h.       */
 # if defined(PCR)
     char * real_malloc(size_t bytes);
-#   define GET_MEM(bytes) HBLKPTR(real_malloc((size_t)(bytes) + GC_page_size) \
+#   define GET_MEM(bytes) HBLKPTR(real_malloc(SIZET_SAT_ADD(bytes, \
+                                                            GC_page_size)) \
                                           + GC_page_size-1)
 # elif defined(OS2)
     void * os2_alloc(size_t bytes);
-#   define GET_MEM(bytes) HBLKPTR((ptr_t)os2_alloc((size_t)(bytes) \
-                                            + GC_page_size) + GC_page_size-1)
+#   define GET_MEM(bytes) HBLKPTR((ptr_t)os2_alloc( \
+                                            SIZET_SAT_ADD(bytes, \
+                                                          GC_page_size)) \
+                                  + GC_page_size-1)
 # elif defined(NEXT) || defined(DOS4GW) || defined(NONSTOP) \
         || (defined(AMIGA) && !defined(GC_AMIGA_FASTALLOC)) \
         || (defined(SOLARIS) && !defined(USE_MMAP)) || defined(RTEMS) \
         || defined(__CC_ARM)
 #   define GET_MEM(bytes) HBLKPTR((size_t)calloc(1, \
-                                            (size_t)(bytes) + GC_page_size) \
+                                            SIZET_SAT_ADD(bytes, \
+                                                          GC_page_size)) \
                                   + GC_page_size - 1)
 # elif defined(MSWIN32) || defined(CYGWIN32)
-    ptr_t GC_win32_get_mem(GC_word bytes);
+    ptr_t GC_win32_get_mem(size_t bytes);
 #   define GET_MEM(bytes) (struct hblk *)GC_win32_get_mem(bytes)
 # elif defined(MACOS)
 #   if defined(USE_TEMPORARY_MEMORY)
       Ptr GC_MacTemporaryNewPtr(size_t size, Boolean clearMemory);
-#     define GET_MEM(bytes) HBLKPTR( \
-                        GC_MacTemporaryNewPtr((bytes) + GC_page_size, true) \
+#     define GET_MEM(bytes) HBLKPTR(GC_MacTemporaryNewPtr( \
+                                        SIZET_SAT_ADD(bytes, \
+                                                      GC_page_size), true) \
                         + GC_page_size-1)
 #   else
-#     define GET_MEM(bytes) HBLKPTR(NewPtrClear((bytes) + GC_page_size) \
+#     define GET_MEM(bytes) HBLKPTR(NewPtrClear(SIZET_SAT_ADD(bytes, \
+                                                              GC_page_size)) \
                                     + GC_page_size-1)
 #   endif
 # elif defined(MSWINCE)
-    ptr_t GC_wince_get_mem(GC_word bytes);
+    ptr_t GC_wince_get_mem(size_t bytes);
 #   define GET_MEM(bytes) (struct hblk *)GC_wince_get_mem(bytes)
 # elif defined(AMIGA) && defined(GC_AMIGA_FASTALLOC)
     void *GC_amiga_get_mem(size_t size);
-#   define GET_MEM(bytes) HBLKPTR((size_t) \
-                          GC_amiga_get_mem((size_t)(bytes) + GC_page_size) \
+#   define GET_MEM(bytes) HBLKPTR((size_t)GC_amiga_get_mem( \
+                                            SIZET_SAT_ADD(bytes, \
+                                                          GC_page_size)) \
                           + GC_page_size-1)
 # elif defined(SN_TARGET_PS3)
     void *ps3_get_mem(size_t size);
 #   define GET_MEM(bytes) (struct hblk*)ps3_get_mem(bytes)
 # else
-    ptr_t GC_unix_get_mem(GC_word bytes);
+    ptr_t GC_unix_get_mem(size_t bytes);
 #   define GET_MEM(bytes) (struct hblk *)GC_unix_get_mem(bytes)
 # endif
 #endif /* GC_PRIVATE_H */
Index: gc-7.2/malloc.c
===================================================================
--- gc-7.2.orig/malloc.c
+++ gc-7.2/malloc.c
@@ -48,7 +48,7 @@ GC_INNER ptr_t GC_alloc_large(size_t lb,
 
     /* Round up to a multiple of a granule. */
       lb = (lb + GRANULE_BYTES - 1) & ~(GRANULE_BYTES - 1);
-    n_blocks = OBJ_SZ_TO_BLOCKS(lb);
+    n_blocks = OBJ_SZ_TO_BLOCKS_CHECKED(lb);
     if (!GC_is_initialized) GC_init();
     /* Do our share of marking work */
         if (GC_incremental && !GC_dont_gc)
@@ -84,10 +84,11 @@ GC_INNER ptr_t GC_alloc_large(size_t lb,
 STATIC ptr_t GC_alloc_large_and_clear(size_t lb, int k, unsigned flags)
 {
     ptr_t result = GC_alloc_large(lb, k, flags);
-    word n_blocks = OBJ_SZ_TO_BLOCKS(lb);
 
     if (0 == result) return 0;
     if (GC_debugging_started || GC_obj_kinds[k].ok_init) {
+        word n_blocks = OBJ_SZ_TO_BLOCKS(lb);
+
         /* Clear the whole block, in case of GC_realloc call. */
         BZERO(result, n_blocks * HBLKSIZE);
     }
@@ -167,8 +168,6 @@ GC_API void * GC_CALL GC_generic_malloc(
         GC_bool init;
         lg = ROUNDED_UP_GRANULES(lb);
         lb_rounded = GRANULES_TO_BYTES(lg);
-        if (lb_rounded < lb)
-            return((*GC_get_oom_fn())(lb));
         n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
         init = GC_obj_kinds[k].ok_init;
         LOCK();
@@ -375,15 +374,6 @@ void * malloc(size_t lb)
   }
 #endif /* GC_LINUX_THREADS */
 
-#include <limits.h>
-#ifdef SIZE_MAX
-# define GC_SIZE_MAX SIZE_MAX
-#else
-# define GC_SIZE_MAX (~(size_t)0)
-#endif
-
-#define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)
-
 void * calloc(size_t n, size_t lb)
 {
     if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial test */
Index: gc-7.2/mallocx.c
===================================================================
--- gc-7.2.orig/mallocx.c
+++ gc-7.2/mallocx.c
@@ -182,8 +182,6 @@ GC_INNER void * GC_generic_malloc_ignore
         return(GC_generic_malloc((word)lb, k));
     lg = ROUNDED_UP_GRANULES(lb);
     lb_rounded = GRANULES_TO_BYTES(lg);
-    if (lb_rounded < lb)
-        return((*GC_get_oom_fn())(lb));
     n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
     init = GC_obj_kinds[k].ok_init;
     if (GC_have_errors) GC_print_all_errors();
@@ -434,9 +432,11 @@ GC_API void GC_CALL GC_generic_malloc_ma
 GC_API void * GC_CALL GC_malloc_many(size_t lb)
 {
     void *result;
-    GC_generic_malloc_many((lb + EXTRA_BYTES + GRANULE_BYTES-1)
-                           & ~(GRANULE_BYTES-1),
-                           NORMAL, &result);
+    /* Add EXTRA_BYTES and round up to a multiple of a granule. */
+    lb = SIZET_SAT_ADD(lb, EXTRA_BYTES + GRANULE_BYTES - 1)
+            & ~(GRANULE_BYTES - 1);
+
+    GC_generic_malloc_many(lb, NORMAL, &result);
     return result;
 }
 
@@ -460,7 +460,7 @@ GC_API void * GC_CALL GC_memalign(size_t
     }
     /* We could also try to make sure that the real rounded-up object size */
     /* is a multiple of align.  That would be correct up to HBLKSIZE.      */
-    new_lb = lb + align - 1;
+    new_lb = SIZET_SAT_ADD(lb, align - 1);
     result = GC_malloc(new_lb);
     offset = (word)result % align;
     if (offset != 0) {
Index: gc-7.2/misc.c
===================================================================
--- gc-7.2.orig/misc.c
+++ gc-7.2/misc.c
@@ -184,7 +184,7 @@ GC_API void GC_CALL GC_set_handle_fork(i
 /* quantization algorithm (but we precompute it).                       */
 STATIC void GC_init_size_map(void)
 {
-    int i;
+    size_t i;
 
     /* Map size 0 to something bigger.                  */
     /* This avoids problems at lower levels.            */
Index: gc-7.2/os_dep.c
===================================================================
--- gc-7.2.orig/os_dep.c
+++ gc-7.2/os_dep.c
@@ -690,7 +690,7 @@ struct o32_obj {
 # endif /* OS/2 */
 
 /* Find the page size */
-GC_INNER word GC_page_size = 0;
+GC_INNER size_t GC_page_size = 0;
 
 #if defined(MSWIN32) || defined(MSWINCE) || defined(CYGWIN32)
 # ifndef VER_PLATFORM_WIN32_CE
@@ -704,7 +704,7 @@ GC_INNER word GC_page_size = 0;
   GC_INNER void GC_setpagesize(void)
   {
     GetSystemInfo(&GC_sysinfo);
-    GC_page_size = GC_sysinfo.dwPageSize;
+    GC_page_size = (size_t)GC_sysinfo.dwPageSize;
 #   if defined(MSWINCE) && !defined(_WIN32_WCE_EMULATION)
       {
         OSVERSIONINFO verInfo;
@@ -781,7 +781,7 @@ GC_INNER word GC_page_size = 0;
   GC_INNER void GC_setpagesize(void)
   {
 #   if defined(MPROTECT_VDB) || defined(PROC_VDB) || defined(USE_MMAP)
-      GC_page_size = GETPAGESIZE();
+      GC_page_size = (size_t)GETPAGESIZE();
       if (!GC_page_size) ABORT("getpagesize() failed");
 #   else
       /* It's acceptable to fake it.    */
@@ -2031,7 +2031,7 @@ void GC_register_data_segments(void)
 #   define HEAP_START ((ptr_t)0)
 #endif
 
-STATIC ptr_t GC_unix_mmap_get_mem(word bytes)
+STATIC ptr_t GC_unix_mmap_get_mem(size_t bytes)
 {
     void *result;
     static ptr_t last_addr = HEAP_START;
@@ -2060,7 +2060,7 @@ STATIC ptr_t GC_unix_mmap_get_mem(word b
         /* Oops.  We got the end of the address space.  This isn't      */
         /* usable by arbitrary C code, since one-past-end pointers      */
         /* don't work, so we discard it and try again.                  */
-        munmap(result, (size_t)(-GC_page_size) - (size_t)result);
+        munmap(result, ~GC_page_size - (size_t)result + 1);
                         /* Leave last page mapped, so we can't repeat.  */
         return GC_unix_mmap_get_mem(bytes);
       }
@@ -2073,13 +2073,13 @@ STATIC ptr_t GC_unix_mmap_get_mem(word b
 # endif  /* MMAP_SUPPORTED */
 
 #if defined(USE_MMAP)
-  ptr_t GC_unix_get_mem(word bytes)
+  ptr_t GC_unix_get_mem(size_t bytes)
   {
     return GC_unix_mmap_get_mem(bytes);
   }
 #else /* !USE_MMAP */
 
-STATIC ptr_t GC_unix_sbrk_get_mem(word bytes)
+STATIC ptr_t GC_unix_sbrk_get_mem(size_t bytes)
 {
   ptr_t result;
 # ifdef IRIX5
@@ -2096,7 +2096,7 @@ STATIC ptr_t GC_unix_sbrk_get_mem(word b
         goto out;
     }
     if (lsbs != 0) {
-        if((ptr_t)sbrk(GC_page_size - lsbs) == (ptr_t)(-1)) {
+        if((ptr_t)sbrk((SBRK_ARG_T)GC_page_size - lsbs) == (ptr_t)(-1)) {
             result = 0;
             goto out;
         }
@@ -2120,7 +2120,7 @@ STATIC ptr_t GC_unix_sbrk_get_mem(word b
   return(result);
 }
 
-ptr_t GC_unix_get_mem(word bytes)
+ptr_t GC_unix_get_mem(size_t bytes)
 {
 # if defined(MMAP_SUPPORTED)
     /* By default, we try both sbrk and mmap, in that order.    */
@@ -2189,7 +2189,7 @@ void * os2_alloc(size_t bytes)
 #endif /* MSWIN32 */
 
 #if defined(MSWIN32) || defined(CYGWIN32)
-  ptr_t GC_win32_get_mem(word bytes)
+  ptr_t GC_win32_get_mem(size_t bytes)
   {
     ptr_t result;
 
@@ -2200,8 +2200,8 @@ void * os2_alloc(size_t bytes)
         /* VirtualAlloc doesn't like PAGE_EXECUTE_READWRITE.    */
         /* There are also unconfirmed rumors of other           */
         /* problems, so we dodge the issue.                     */
-        result = (ptr_t) GlobalAlloc(0, bytes + HBLKSIZE);
-        result = (ptr_t)(((word)result + HBLKSIZE - 1) & ~(HBLKSIZE-1));
+        result = (ptr_t)(((word)GlobalAlloc(0, SIZET_SAT_ADD(bytes, HBLKSIZE))
+                            + HBLKSIZE - 1) & ~(HBLKSIZE - 1));
     } else {
         /* VirtualProtect only works on regions returned by a   */
         /* single VirtualAlloc call.  Thus we allocate one      */
@@ -2228,12 +2228,13 @@ void * os2_alloc(size_t bytes)
         /* available.  Otherwise we waste resources or possibly */
         /* cause VirtualAlloc to fail (observed in Windows 2000 */
         /* SP2).                                                */
-        result = (ptr_t) VirtualAlloc(NULL, bytes + VIRTUAL_ALLOC_PAD,
-                                GetWriteWatch_alloc_flag
+        result = (ptr_t) VirtualAlloc(NULL,
+                            SIZET_SAT_ADD(bytes, VIRTUAL_ALLOC_PAD),
+                            GetWriteWatch_alloc_flag
                                 | (MEM_COMMIT | MEM_RESERVE)
                                 | GC_mem_top_down,
-                                GC_pages_executable ? PAGE_EXECUTE_READWRITE :
-                                                      PAGE_READWRITE);
+                            GC_pages_executable ? PAGE_EXECUTE_READWRITE :
+                                                  PAGE_READWRITE);
 #       undef IGNORE_PAGES_EXECUTABLE
     }
 # endif /* !CYGWIN32 */
@@ -2271,7 +2272,7 @@ void * os2_alloc(size_t bytes)
 
 
 #ifdef MSWINCE
-  ptr_t GC_wince_get_mem(word bytes)
+  ptr_t GC_wince_get_mem(size_t bytes)
   {
     ptr_t result = 0; /* initialized to prevent warning. */
     word i;
@@ -2291,8 +2292,9 @@ void * os2_alloc(size_t bytes)
 
     if (i == GC_n_heap_bases) {
         /* Reserve more pages */
-        word res_bytes = (bytes + GC_sysinfo.dwAllocationGranularity-1)
-                         & ~(GC_sysinfo.dwAllocationGranularity-1);
+        size_t res_bytes =
+            SIZET_SAT_ADD(bytes, (size_t)GC_sysinfo.dwAllocationGranularity-1)
+            & ~((size_t)GC_sysinfo.dwAllocationGranularity-1);
         /* If we ever support MPROTECT_VDB here, we will probably need to    */
         /* ensure that res_bytes is strictly > bytes, so that VirtualProtect */
         /* never spans regions.  It seems to be OK for a VirtualFree         */
@@ -3115,7 +3117,7 @@ STATIC void GC_default_push_other_roots(
         char * addr = (char *) (exc_info -> ExceptionRecord
                                 -> ExceptionInformation[1]);
 #   endif
-    unsigned i;
+    size_t i;
 
     if (SIG_OK && CODE_OK) {
         register struct hblk * h =
@@ -4286,7 +4288,7 @@ catch_exception_raise(mach_port_t except
   kern_return_t r;
   char *addr;
   struct hblk *h;
-  unsigned int i;
+  size_t i;
   thread_state_flavor_t flavor = DARWIN_EXC_STATE;
   mach_msg_type_number_t exc_state_count = DARWIN_EXC_STATE_COUNT;
   DARWIN_EXC_STATE_T exc_state;
Index: gc-7.2/typd_mlc.c
===================================================================
--- gc-7.2.orig/typd_mlc.c
+++ gc-7.2/typd_mlc.c
@@ -587,7 +587,7 @@ GC_API void * GC_CALL GC_malloc_explicit
     size_t lg;
     DCL_LOCK_STATE;
 
-    lb += TYPD_EXTRA_BYTES;
+    lb = SIZET_SAT_ADD(lb, TYPD_EXTRA_BYTES);
     if(SMALL_OBJ(lb)) {
         lg = GC_size_map[lb];
         opp = &(GC_eobjfreelist[lg]);
@@ -622,7 +622,7 @@ GC_API void * GC_CALL GC_malloc_explicit
     size_t lg;
     DCL_LOCK_STATE;
 
-    lb += TYPD_EXTRA_BYTES;
+    lb = SIZET_SAT_ADD(lb, TYPD_EXTRA_BYTES);
     if( SMALL_OBJ(lb) ) {
         lg = GC_size_map[lb];
         opp = &(GC_eobjfreelist[lg]);
@@ -649,6 +649,15 @@ GC_API void * GC_CALL GC_malloc_explicit
    return((void *) op);
 }
 
+#include <limits.h>
+#ifdef SIZE_MAX
+# define GC_SIZE_MAX SIZE_MAX
+#else
+# define GC_SIZE_MAX (~(size_t)0)
+#endif
+
+#define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)
+
 GC_API void * GC_CALL GC_calloc_explicitly_typed(size_t n, size_t lb,
                                                  GC_descr d)
 {
@@ -663,16 +672,20 @@ GC_API void * GC_CALL GC_calloc_explicit
 
     descr_type = GC_make_array_descriptor((word)n, (word)lb, d,
                                           &simple_descr, &complex_descr, &leaf);
+    if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial check */
+        && lb > 0 && n > GC_SIZE_MAX / lb)
+      return NULL; /* n*lb overflow */
+    lb *= n;
     switch(descr_type) {
         case NO_MEM: return(0);
-        case SIMPLE: return(GC_malloc_explicitly_typed(n*lb, simple_descr));
+        case SIMPLE:
+            return GC_malloc_explicitly_typed(lb, simple_descr);
         case LEAF:
-            lb *= n;
-            lb += sizeof(struct LeafDescriptor) + TYPD_EXTRA_BYTES;
+            lb = SIZET_SAT_ADD(lb,
+                        sizeof(struct LeafDescriptor) + TYPD_EXTRA_BYTES);
             break;
         case COMPLEX:
-            lb *= n;
-            lb += TYPD_EXTRA_BYTES;
+            lb = SIZET_SAT_ADD(lb, TYPD_EXTRA_BYTES);
             break;
     }
     if( SMALL_OBJ(lb) ) {

Places

File CVE-2016-9427.patch of Package gc (Revision 882dfca034bc0a2c4760ae53c00300b8)

Places