# 

# Backport xmallocarray, an overflow checking version of xmalloc (CVE-2014-5044)

# 

# 2014-07-31  Janne Blomqvist  <[email protected]>

# 

# 	Backport from mainline

# 	CVE-2014-5044

#         * libgfortran.h (xmallocarray): New prototype.

#         * runtime/memory.c (xmallocarray): New function.

#         (xcalloc): Check for nonzero separately instead of multiplying.

#         * generated/*.c: Regenerated.

#         * intrinsics/cshift0.c (cshift0): Call xmallocarray instead of

#         xmalloc.

#         * intrinsics/eoshift0.c (eoshift0): Likewise.

#         * intrinsics/eoshift2.c (eoshift2): Likewise.

#         * intrinsics/pack_generic.c (pack_internal): Likewise.

#         (pack_s_internal): Likewise.

#         * intrinsics/reshape_generic.c (reshape_internal): Likewise.

#         * intrinsics/spread_generic.c (spread_internal): Likewise.

#         (spread_internal_scalar): Likewise.

#         * intrinsics/string_intrinsics_inc.c (string_trim): Likewise.

#         (string_minmax): Likewise.

#         * intrinsics/transpose_generic.c (transpose_internal): Likewise.

#         * intrinsics/unpack_generic.c (unpack_internal): Likewise.

#         * io/list_read.c (nml_touch_nodes): Don't cast xmalloc return value.

#         * io/transfer.c (st_set_nml_var): Call xmallocarray instead of

#         xmalloc.

#         * io/unit.c (get_internal_unit): Likewise.

#         (filename_from_unit): Don't cast xmalloc return value.

#         * io/write.c (nml_write_obj): Likewise, formatting.

#         * m4/bessel.m4 (bessel_jn_r'rtype_kind`): Call xmallocarray

#         instead of xmalloc.

#         (besse_yn_r'rtype_kind`): Likewise.

#         * m4/cshift1.m4 (cshift1): Likewise.

#         * m4/eoshift1.m4 (eoshift1): Likewise.

#         * m4/eoshift3.m4 (eoshift3): Likewise.

#         * m4/iforeach.m4: Likewise.

#         * m4/ifunction.m4: Likewise.

#         * m4/ifunction_logical.m4 (name`'rtype_qual`_'atype_code):

#         Likewise.

#         * m4/in_pack.m4 (internal_pack_'rtype_ccode`): Likewise.

#         * m4/matmul.m4 (matmul_'rtype_code`): Likewise.

#         * m4/matmull.m4 (matmul_'rtype_code`): Likewise.

#         * m4/pack.m4 (pack_'rtype_code`): Likewise.

#         * m4/reshape.m4 (reshape_'rtype_ccode`): Likewise.

#         * m4/shape.m4 (shape_'rtype_kind`): Likewise.

#         * m4/spread.m4 (spread_'rtype_code`): Likewise.

#         (spread_scalar_'rtype_code`): Likewise.

#         * m4/transpose.m4 (transpose_'rtype_code`): Likewise.

#         * m4/unpack.m4 (unpack0_'rtype_code`): Likewise.

#         (unpack1_'rtype_code`): Likewise.

#         * runtime/convert_char.c (convert_char1_to_char4): Likewise.

#         (convert_char4_to_char1): Simplify.

#         * runtime/environ.c (init_unformatted): Call xmallocarray instead

#         of xmalloc.

#         * runtime/in_pack_generic.c (internal_pack): Likewise.

# 

Index: gcc-4.8_branch/libgfortran/m4/in_pack.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/in_pack.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/in_pack.m4	(revision 213313)

@@ -79,7 +79,7 @@

     return source->base_addr;

   /* Allocate storage for the destination.  */

-  destptr = ('rtype_name` *)xmalloc (ssize * sizeof ('rtype_name`));

+  destptr = xmallocarray (ssize, sizeof ('rtype_name`));

   dest = destptr;

   src = source->base_addr;

   stride0 = stride[0];

Index: gcc-4.8_branch/libgfortran/m4/pack.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/pack.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/pack.m4	(revision 213313)

@@ -168,8 +168,8 @@

 	  ret->offset = 0;

-	  /* xmalloc allocates a single byte for zero size.  */

-	  ret->base_addr = xmalloc (sizeof ('rtype_name`) * total);

+	  /* xmallocarray allocates a single byte for zero size.  */

+	  ret->base_addr = xmallocarray (total, sizeof ('rtype_name`));

 	  if (total == 0)

 	    return;

Index: gcc-4.8_branch/libgfortran/m4/spread.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/spread.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/spread.m4	(revision 213313)

@@ -102,8 +102,8 @@

 	}

       ret->offset = 0;

-      /* xmalloc allocates a single byte for zero size.  */

-      ret->base_addr = xmalloc (rs * sizeof('rtype_name`));

+      /* xmallocarray allocates a single byte for zero size.  */

+      ret->base_addr = xmallocarray (rs, sizeof('rtype_name`));

       if (rs <= 0)

         return;

     }

@@ -245,7 +245,7 @@

   if (ret->base_addr == NULL)

     {

-      ret->base_addr = xmalloc (ncopies * sizeof ('rtype_name`));

+      ret->base_addr = xmallocarray (ncopies, sizeof ('rtype_name`));

       ret->offset = 0;

       GFC_DIMENSION_SET(ret->dim[0], 0, ncopies - 1, 1);

     }

Index: gcc-4.8_branch/libgfortran/m4/transpose.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/transpose.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/transpose.m4	(revision 213313)

@@ -61,7 +61,8 @@

       GFC_DIMENSION_SET(ret->dim[1], 0, GFC_DESCRIPTOR_EXTENT(source,0) - 1,

 			GFC_DESCRIPTOR_EXTENT(source, 1));

-      ret->base_addr = xmalloc (sizeof ('rtype_name`) * size0 ((array_t *) ret));

+      ret->base_addr = xmallocarray (size0 ((array_t *) ret), 

+                                     sizeof ('rtype_name`));

       ret->offset = 0;

     } else if (unlikely (compile_options.bounds_check))

     {

Index: gcc-4.8_branch/libgfortran/m4/iforeach.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/iforeach.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/iforeach.m4	(revision 213313)

@@ -30,7 +30,7 @@

       GFC_DIMENSION_SET(retarray->dim[0], 0, rank-1, 1);

       retarray->dtype = (retarray->dtype & ~GFC_DTYPE_RANK_MASK) | 1;

       retarray->offset = 0;

-      retarray->base_addr = xmalloc (sizeof (rtype_name) * rank);

+      retarray->base_addr = xmallocarray (rank, sizeof (rtype_name));

     }

   else

     {

@@ -133,7 +133,7 @@

       GFC_DIMENSION_SET(retarray->dim[0], 0, rank - 1, 1);

       retarray->dtype = (retarray->dtype & ~GFC_DTYPE_RANK_MASK) | 1;

       retarray->offset = 0;

-      retarray->base_addr = xmalloc (sizeof (rtype_name) * rank);

+      retarray->base_addr = xmallocarray (rank, sizeof (rtype_name));

     }

   else

     {

@@ -264,7 +264,7 @@

       GFC_DIMENSION_SET(retarray->dim[0], 0, rank-1, 1);

       retarray->dtype = (retarray->dtype & ~GFC_DTYPE_RANK_MASK) | 1;

       retarray->offset = 0;

-      retarray->base_addr = xmalloc (sizeof (rtype_name) * rank);

+      retarray->base_addr = xmallocarray (rank, sizeof (rtype_name));

     }

   else if (unlikely (compile_options.bounds_check))

     {

Index: gcc-4.8_branch/libgfortran/m4/eoshift1.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/eoshift1.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/eoshift1.m4	(revision 213313)

@@ -106,8 +106,8 @@

 	  GFC_DIMENSION_SET(ret->dim[i], 0, ub, str);

         }

-      /* xmalloc allocates a single byte for zero size.  */

-      ret->base_addr = xmalloc (size * arraysize);

+      /* xmallocarray allocates a single byte for zero size.  */

+      ret->base_addr = xmallocarray (arraysize, size);

     }

   else if (unlikely (compile_options.bounds_check))

Index: gcc-4.8_branch/libgfortran/m4/eoshift3.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/eoshift3.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/eoshift3.m4	(revision 213313)

@@ -90,7 +90,7 @@

     {

       int i;

-      ret->base_addr = xmalloc (size * arraysize);

+      ret->base_addr = xmallocarray (arraysize, size);

       ret->offset = 0;

       ret->dtype = array->dtype;

       for (i = 0; i < GFC_DESCRIPTOR_RANK (array); i++)

@@ -108,8 +108,8 @@

 	  GFC_DIMENSION_SET(ret->dim[i], 0, ub, str);

         }

-      /* xmalloc allocates a single byte for zero size.  */

-      ret->base_addr = xmalloc (size * arraysize);

+      /* xmallocarray allocates a single byte for zero size.  */

+      ret->base_addr = xmallocarray (arraysize, size);

     }

   else if (unlikely (compile_options.bounds_check))

Index: gcc-4.8_branch/libgfortran/m4/shape.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/shape.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/shape.m4	(revision 213313)

@@ -50,7 +50,7 @@

     {

       GFC_DIMENSION_SET(ret->dim[0], 0, rank - 1, 1);

       ret->offset = 0;

-      ret->base_addr = xmalloc (sizeof ('rtype_name`) * rank);

+      ret->base_addr = xmallocarray (rank, sizeof ('rtype_name`));

     }

   stride = GFC_DESCRIPTOR_STRIDE(ret,0);

Index: gcc-4.8_branch/libgfortran/m4/cshift1.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/cshift1.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/cshift1.m4	(revision 213313)

@@ -81,7 +81,7 @@

     {

       int i;

-      ret->base_addr = xmalloc (size * arraysize);

+      ret->base_addr = xmallocarray (arraysize, size);

       ret->offset = 0;

       ret->dtype = array->dtype;

       for (i = 0; i < GFC_DESCRIPTOR_RANK (array); i++)

Index: gcc-4.8_branch/libgfortran/m4/matmull.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/matmull.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/matmull.m4	(revision 213313)

@@ -89,7 +89,7 @@

         }

       retarray->base_addr

-	= xmalloc (sizeof ('rtype_name`) * size0 ((array_t *) retarray));

+	= xmallocarray (size0 ((array_t *) retarray), sizeof ('rtype_name`));

       retarray->offset = 0;

     }

     else if (unlikely (compile_options.bounds_check))

Index: gcc-4.8_branch/libgfortran/m4/bessel.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/bessel.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/bessel.m4	(revision 213313)

@@ -56,7 +56,7 @@

     {

       size_t size = n2 < n1 ? 0 : n2-n1+1; 

       GFC_DIMENSION_SET(ret->dim[0], 0, size-1, 1);

-      ret->base_addr = xmalloc (sizeof ('rtype_name`) * size);

+      ret->base_addr = xmallocarray (size, sizeof ('rtype_name`));

       ret->offset = 0;

     }

@@ -123,7 +123,7 @@

     {

       size_t size = n2 < n1 ? 0 : n2-n1+1; 

       GFC_DIMENSION_SET(ret->dim[0], 0, size-1, 1);

-      ret->base_addr = xmalloc (sizeof ('rtype_name`) * size);

+      ret->base_addr = xmallocarray (size, sizeof ('rtype_name`));

       ret->offset = 0;

     }

Index: gcc-4.8_branch/libgfortran/m4/unpack.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/unpack.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/unpack.m4	(revision 213313)

@@ -100,7 +100,7 @@

 	  rs *= extent[n];

 	}

       ret->offset = 0;

-      ret->base_addr = xmalloc (rs * sizeof ('rtype_name`));

+      ret->base_addr = xmallocarray (rs, sizeof ('rtype_name`));

     }

   else

     {

@@ -245,7 +245,7 @@

 	  rs *= extent[n];

 	}

       ret->offset = 0;

-      ret->base_addr = xmalloc (rs * sizeof ('rtype_name`));

+      ret->base_addr = xmallocarray (rs, sizeof ('rtype_name`));

     }

   else

     {

Index: gcc-4.8_branch/libgfortran/m4/reshape.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/reshape.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/reshape.m4	(revision 213313)

@@ -115,11 +115,11 @@

       ret->offset = 0;

       if (unlikely (rs < 1))

-        alloc_size = 1;

+        alloc_size = 0;

       else

-        alloc_size = rs * sizeof ('rtype_name`);

+        alloc_size = rs;

-      ret->base_addr = xmalloc (alloc_size);

+      ret->base_addr = xmallocarray (alloc_size, sizeof ('rtype_name`));

       ret->dtype = (source->dtype & ~GFC_DTYPE_RANK_MASK) | rdim;

     }

Index: gcc-4.8_branch/libgfortran/m4/ifunction_logical.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/ifunction_logical.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/ifunction_logical.m4	(revision 213313)

@@ -89,8 +89,7 @@

       retarray->offset = 0;

       retarray->dtype = (array->dtype & ~GFC_DTYPE_RANK_MASK) | rank;

-      alloc_size = sizeof (rtype_name) * GFC_DESCRIPTOR_STRIDE(retarray,rank-1)

-    		   * extent[rank-1];

+      alloc_size = GFC_DESCRIPTOR_STRIDE(retarray,rank-1) * extent[rank-1];

       if (alloc_size == 0)

 	{

@@ -99,7 +98,7 @@

 	  return;

 	}

       else

-	retarray->base_addr = xmalloc (alloc_size);

+	retarray->base_addr = xmallocarray (alloc_size, sizeof (rtype_name));

     }

   else

     {

Index: gcc-4.8_branch/libgfortran/m4/ifunction.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/ifunction.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/ifunction.m4	(revision 213313)

@@ -85,10 +85,9 @@

       retarray->offset = 0;

       retarray->dtype = (array->dtype & ~GFC_DTYPE_RANK_MASK) | rank;

-      alloc_size = sizeof (rtype_name) * GFC_DESCRIPTOR_STRIDE(retarray,rank-1)

-    		   * extent[rank-1];

+      alloc_size = GFC_DESCRIPTOR_STRIDE(retarray,rank-1) * extent[rank-1];

-      retarray->base_addr = xmalloc (alloc_size);

+      retarray->base_addr = xmallocarray (alloc_size, sizeof (rtype_name));

       if (alloc_size == 0)

 	{

 	  /* Make sure we have a zero-sized array.  */

@@ -260,8 +259,7 @@

 	}

-      alloc_size = sizeof (rtype_name) * GFC_DESCRIPTOR_STRIDE(retarray,rank-1)

-    		   * extent[rank-1];

+      alloc_size = GFC_DESCRIPTOR_STRIDE(retarray,rank-1) * extent[rank-1];

       retarray->offset = 0;

       retarray->dtype = (array->dtype & ~GFC_DTYPE_RANK_MASK) | rank;

@@ -273,7 +271,7 @@

 	  return;

 	}

       else

-	retarray->base_addr = xmalloc (alloc_size);

+	retarray->base_addr = xmallocarray (alloc_size, sizeof (rtype_name));

     }

   else

@@ -417,8 +415,7 @@

       retarray->offset = 0;

       retarray->dtype = (array->dtype & ~GFC_DTYPE_RANK_MASK) | rank;

-      alloc_size = sizeof (rtype_name) * GFC_DESCRIPTOR_STRIDE(retarray,rank-1)

-    		   * extent[rank-1];

+      alloc_size = GFC_DESCRIPTOR_STRIDE(retarray,rank-1) * extent[rank-1];

       if (alloc_size == 0)

 	{

@@ -427,7 +424,7 @@

 	  return;

 	}

       else

-	retarray->base_addr = xmalloc (alloc_size);

+	retarray->base_addr = xmallocarray (alloc_size, sizeof (rtype_name));

     }

   else

     {

Index: gcc-4.8_branch/libgfortran/m4/matmul.m4

===================================================================

--- gcc-4.8_branch/libgfortran/m4/matmul.m4	(revision 213312)

+++ gcc-4.8_branch/libgfortran/m4/matmul.m4	(revision 213313)

@@ -125,7 +125,7 @@

         }

       retarray->base_addr

-	= xmalloc (sizeof ('rtype_name`) * size0 ((array_t *) retarray));

+	= xmallocarray (size0 ((array_t *) retarray), sizeof ('rtype_name`));

       retarray->offset = 0;

     }

     else if (unlikely (compile_options.bounds_check))

Index: gcc-4.8_branch/libgfortran/runtime/in_pack_generic.c

===================================================================

--- gcc-4.8_branch/libgfortran/runtime/in_pack_generic.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/runtime/in_pack_generic.c	(revision 213313)

@@ -180,7 +180,7 @@

     return source->base_addr;

    /* Allocate storage for the destination.  */

-  destptr = xmalloc (ssize * size);

+  destptr = xmallocarray (ssize, size);

   dest = (char *)destptr;

   src = source->base_addr;

   stride0 = stride[0] * size;

Index: gcc-4.8_branch/libgfortran/runtime/memory.c

===================================================================

--- gcc-4.8_branch/libgfortran/runtime/memory.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/runtime/memory.c	(revision 213313)

@@ -25,8 +25,13 @@

 #include "libgfortran.h"

 #include <stdlib.h>

+#include <errno.h>

+#ifndef SIZE_MAX

+#define SIZE_MAX ((size_t)-1)

+#endif

+

 void *

 xmalloc (size_t n)

 {

@@ -44,12 +49,34 @@

 }

+void *

+xmallocarray (size_t nmemb, size_t size)

+{

+  void *p;

+

+  if (!nmemb || !size)

+    size = nmemb = 1;

+  else if (nmemb > SIZE_MAX / size)

+    {

+      errno = ENOMEM;

+      os_error ("Integer overflow in xmallocarray");

+    }

+

+  p = malloc (nmemb * size);

+

+  if (!p)

+    os_error ("Memory allocation failed in xmallocarray");

+

+  return p;

+}

+

+

 /* calloc wrapper that aborts on error.  */

 void *

 xcalloc (size_t nmemb, size_t size)

 {

-  if (nmemb * size == 0)

+  if (!nmemb || !size)

     nmemb = size = 1;

   void *p = calloc (nmemb, size);

Index: gcc-4.8_branch/libgfortran/runtime/convert_char.c

===================================================================

--- gcc-4.8_branch/libgfortran/runtime/convert_char.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/runtime/convert_char.c	(revision 213313)

@@ -44,7 +44,7 @@

   gfc_charlen_type i, l;

   l = len > 0 ? len : 0;

-  *dst = xmalloc ((l + 1) * sizeof (gfc_char4_t));

+  *dst = xmallocarray ((l + 1), sizeof (gfc_char4_t));

   for (i = 0; i < l; i++)

     (*dst)[i] = src[i];

@@ -60,7 +60,7 @@

   gfc_charlen_type i, l;

   l = len > 0 ? len : 0;

-  *dst = xmalloc ((l + 1) * sizeof (unsigned char));

+  *dst = xmalloc (l + 1);

   for (i = 0; i < l; i++)

     (*dst)[i] = src[i];

Index: gcc-4.8_branch/libgfortran/runtime/environ.c

===================================================================

--- gcc-4.8_branch/libgfortran/runtime/environ.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/runtime/environ.c	(revision 213313)

@@ -833,7 +833,7 @@

     }

   else

     {

-      elist = xmalloc (unit_count * sizeof (exception_t));

+      elist = xmallocarray (unit_count, sizeof (exception_t));

       do_count = 0;

       p = val;

       do_parse ();

Index: gcc-4.8_branch/libgfortran/intrinsics/string_intrinsics_inc.c

===================================================================

--- gcc-4.8_branch/libgfortran/intrinsics/string_intrinsics_inc.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/intrinsics/string_intrinsics_inc.c	(revision 213313)

@@ -164,7 +164,7 @@

   else

     {

       /* Allocate space for result string.  */

-      *dest = xmalloc (*len * sizeof (CHARTYPE));

+      *dest = xmallocarray (*len, sizeof (CHARTYPE));

       /* Copy string if necessary.  */

       memcpy (*dest, src, *len * sizeof (CHARTYPE));

@@ -442,7 +442,7 @@

     *dest = &zero_length_string;

   else

     {

-      CHARTYPE *tmp = xmalloc (*rlen * sizeof (CHARTYPE));

+      CHARTYPE *tmp = xmallocarray (*rlen, sizeof (CHARTYPE));

       memcpy (tmp, res, reslen * sizeof (CHARTYPE));

       MEMSET (&tmp[reslen], ' ', *rlen - reslen);

       *dest = tmp;

Index: gcc-4.8_branch/libgfortran/intrinsics/pack_generic.c

===================================================================

--- gcc-4.8_branch/libgfortran/intrinsics/pack_generic.c	(revision 213312)

+++ gcc-4.8_branch/libgfortran/intrinsics/pack_generic.c	(revision 213313)

@@ -152,8 +152,8 @@

 	  GFC_DIMENSION_SET(ret->dim[0], 0, total-1, 1);

 	  ret->offset = 0;

-	  /* xmalloc allocates a single byte for zero size.  */

-	  ret->base_addr = xmalloc (size * total);

+	  /* xmallocarray allocates a single byte for zero size.  */

+	  ret->base_addr = xmallocarray (total, size);

 	  if (total == 0)

 	    return;      /* In this case, nothing remains to be done.  */

@@ -519,7 +519,7 @@

       ret->offset = 0;