From 3464200cfa6fa0632af0783a843d9531afadaa19 Mon Sep 17 00:00:00 2001 From: qinyu Date: Thu, 16 Dec 2021 12:19:20 +0800 Subject: [PATCH] fix out of bounds read in xlarrv fix CVE-2021-4048 Signed-off-by: qinyu (cherry picked from commit 590accfec4c98724be4f2e8fbb8f31e5aced682c) --- 0001-Fix-out-of-bounds-read-in-slarrv.patch | 81 +++++++++++++++++++++ lapack.spec | 7 +- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 0001-Fix-out-of-bounds-read-in-slarrv.patch diff --git a/0001-Fix-out-of-bounds-read-in-slarrv.patch b/0001-Fix-out-of-bounds-read-in-slarrv.patch new file mode 100644 index 0000000..fc8c24e --- /dev/null +++ b/0001-Fix-out-of-bounds-read-in-slarrv.patch @@ -0,0 +1,81 @@ +From 0631b6beaed60ba118b0b027c0f8d35397bf5df0 Mon Sep 17 00:00:00 2001 +From: Keno Fischer +Date: Thu, 30 Sep 2021 03:51:23 -0400 +Subject: [PATCH] Fix out of bounds read in slarrv + +This was originally reported as https://github.com/JuliaLang/julia/issues/42415. +I've tracked this down to an our of bounds read on the following line: + +https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L423 + +In the crashing example, `M` is `0`, causing `slarrv` to read uninitialized +memory from the work array. I believe the `0` for `M` is correct and indeed, +the documentation above supports that `M` may be zero: + +https://github.com/Reference-LAPACK/lapack/blob/44ecb6a5ff821b1cbb39f8cc2166cb098e060b4d/SRC/slarrv.f#L113-L116 + +I believe it may be sufficient to early-out this function as suggested +in this PR. However, I have limited context for the full routine here, +so I would appreciate a sanity check. +--- + SRC/clarrv.f | 2 +- + SRC/dlarrv.f | 2 +- + SRC/slarrv.f | 2 +- + SRC/zlarrv.f | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/SRC/clarrv.f b/SRC/clarrv.f +index 1f09e4d..42f7107 100644 +--- a/SRC/clarrv.f ++++ b/SRC/clarrv.f +@@ -348,7 +348,7 @@ + * + * Quick return if possible + * +- IF( N.LE.0 ) THEN ++ IF( (N.LE.0).OR.(M.LE.0) ) THEN + RETURN + END IF + * +diff --git a/SRC/dlarrv.f b/SRC/dlarrv.f +index b036c1e..2994303 100644 +--- a/SRC/dlarrv.f ++++ b/SRC/dlarrv.f +@@ -350,7 +350,7 @@ + * + * Quick return if possible + * +- IF( N.LE.0 ) THEN ++ IF( (N.LE.0).OR.(M.LE.0) ) THEN + RETURN + END IF + * +diff --git a/SRC/slarrv.f b/SRC/slarrv.f +index 9d72b33..95f94fd 100644 +--- a/SRC/slarrv.f ++++ b/SRC/slarrv.f +@@ -350,7 +350,7 @@ + * + * Quick return if possible + * +- IF( N.LE.0 ) THEN ++ IF( (N.LE.0).OR.(M.LE.0) ) THEN + RETURN + END IF + * +diff --git a/SRC/zlarrv.f b/SRC/zlarrv.f +index 51ec558..e4be63e 100644 +--- a/SRC/zlarrv.f ++++ b/SRC/zlarrv.f +@@ -348,7 +348,7 @@ + * + * Quick return if possible + * +- IF( N.LE.0 ) THEN ++ IF( (N.LE.0).OR.(M.LE.0) ) THEN + RETURN + END IF + * +-- +1.8.3.1 + diff --git a/lapack.spec b/lapack.spec index 7ae05b0..a9d40e8 100644 --- a/lapack.spec +++ b/lapack.spec @@ -5,13 +5,15 @@ Name: lapack Version: %{mediumver}.0 -Release: 3 +Release: 4 Summary: The LAPACK libraries for numerical linear algebra. License: BSD URL: http://www.netlib.org/lapack/ Source0: https://github.com/Reference-LAPACK/lapack/archive/v%{version}.tar.gz Source1: http://www.netlib.org/lapack/manpages.tgz +Patch1: 0001-Fix-out-of-bounds-read-in-slarrv.patch + BuildRequires: git gcc-gfortran Provides: blas = %{version}-%{release} Obsoletes: blas < %{version}-%{release} @@ -205,6 +207,9 @@ sed -i 's|@LAPACK_VERSION@|%{version}|g' %{buildroot}%{_libdir}/pkgconfig/lapack %endif %changelog +* Thu Dec 16 2021 qinyu - 3.9.0-4 +- fix out of bounds read in xlarrv + * Thu Mar 18 2021 maminjie - 3.9.0-3 - Fix the position of CFLAGS added -- Gitee