• Tony Cook's avatar
    (perl #131844) fix various space calculation issues in pp_pack.c · c153c205
    Tony Cook authored
    - for the originally reported case, if the start/cur pointer is in the
      top 75% of the address space the add (cur) + glen addition would
      overflow, resulting in the condition failing incorrectly.
    
    - the addition of the existing space used to the space needed could
      overflow, resulting in too small an allocation and a buffer overflow.
    
    - the scaling for UTF8 could overflow.
    
    - the multiply to calculate the space needed for many items could
      overflow.
    
    For the first case, do a space calculation without making new pointers.
    
    For the other cases, detect the overflow and croak if there's an
    overflow.
    
    Originally this used Size_t_MAX as the maximum size of a memory
    allocation, but for -DDEBUGGING builds realloc() throws a panic for
    allocations over half the address space in size, changing the error
    reported for the allocation.
    
    For non-DEBUGGING builds the Size_t_MAX limit has the small chance
    of finding a system that has 3GB of contiguous space available, and
    allocating that space, which could be a denial of servce in some cases.
    
    Unfortunately changing the limit to half the address space means that
    the exact case with the original issue can no longer occur, so the
    test is no longer testing against the address + length issue that
    caused the original problem, since the allocation is failing earlier.
    
    One option would be to change the test so the size request by pack is
    just under 2GB, but this has a higher (but still low) probability that
    the system has the address space available, and will actually try to
    allocate the memory, so let's not do that.
    
    Origin: backport
    Bug: https://rt.perl.org/Public/Bug/Display.html?id=131844
    Patch-Name: fixes/CVE-2018-6913.diff
    c153c205