[Bug other/54411] libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

[egallager at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411

Eric Gallager <egallager at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
                 CC|                            |egallager at gcc dot gnu.org
         Resolution|---                         |FIXED

--- Comment #6 from Eric Gallager <egallager at gcc dot gnu.org> ---
(In reply to Florian Weimer from comment #5)
> Author: fw
> Date: Tue Sep 18 08:34:05 2012
> New Revision: 191413
> 
> URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=191413
> Log:
> PR other/54411: integer overflow in objalloc_alloc
> 
> 2012-09-18  Florian Weimer  <fweimer@redhat.com>
> 
> 	PR other/54411
> 	* objalloc.h (objalloc_alloc): Do not use fast path on wraparound.
> 
> 2012-09-18  Florian Weimer  <fweimer@redhat.com>
> 
> 	PR other/54411
> 	* objalloc.c (_objalloc_alloc): Add overflow check covering
> 	alignment and CHUNK_HEADER_SIZE addition.
> 
> Modified:
>     trunk/include/ChangeLog
>     trunk/include/objalloc.h
>     trunk/libiberty/ChangeLog
>     trunk/libiberty/objalloc.c

Looks like this fixed it.