diff options
| author | Andreas Schwab <schwab@suse.de> | 2018-05-22 10:37:59 +0200 |
|---|---|---|
| committer | Andreas Schwab <schwab@suse.de> | 2018-05-23 09:50:57 +0200 |
| commit | 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e (patch) | |
| tree | 8ce316f806948a2b6f3c29335d39e861dc91df84 /ChangeLog | |
| parent | 8f145c77123a565b816f918969e0e35ee5b89153 (diff) | |
| download | glibc-9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e.tar.gz | |
Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
When compiled as mempcpy, the return value is the end of the destination
buffer, thus it cannot be used to refer to the start of it.
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -1,3 +1,12 @@ +2018-05-23 Andreas Schwab <schwab@suse.de> + + [BZ #23196] + CVE-2018-11237 + * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S + (L(preloop_large)): Save initial destination pointer in %r11 and + use it instead of %rax after the loop. + * string/test-mempcpy.c (MIN_PAGE_SIZE): Define. + 2018-05-22 Joseph Myers <joseph@codesourcery.com> * sysdeps/aarch64/Implies: Remove aarch64/soft-fp. |