This fixes CVE-2014-8611 correctly. The commit that purported to fix CVE-2014-8611 (805288c2f062) only hid it behind another bug. Two later commits, 86a16ada1ea6 and 44cf1e5eb470, attempted to address this new bug but mostly just confused the issue. This commit rolls back the three previous changes and fixes CVE-2014-8611 correctly. The key to understanding the bug (and the fix) is that `_w` has different meanings for different stream modes. If the stream is unbuffered, it is always zero. If the stream is fully buffered, it is the amount of space remaining in the buffer (equal to the buffer size when the buffer is empty and zero when the buffer is full). If the stream is line-buffered, it is a negative number reflecting the amount of data in the buffer (zero when the buffer is empty and negative buffer size when the buffer is full). At the heart of `fflush()`, we call the stream's write function in a loop, where `t` represents the return value from the last call and `n` the amount of data that remains to be written. When the write function fails, we need to move the unwritten data to the top of the buffer (unless nothing was written) and adjust `_p` (which points to the next free location in the buffer) and `_w` accordingly. These variables have already been set to the values they should have after a successful flush, so instead of adjusting them down to reflect what was written, we're adjusting them up to reflect what remains. The bug was that while `_p` was always adjusted, we only adjusted `_w` if the stream was fully buffered. The fix is to also adjust `_w` for line-buffered streams. Everything else is just noise. Fixes: 805288c2f062 Fixes: 86a16ada1ea6 Fixes: 44cf1e5eb470 Sponsored by: Klara, Inc. (cherry picked from commit 1f90b4edffe815aebb35e74b79e10593b31f6b75) (cherry picked from commit 1e99535be2ea9c0ef8bc57fc885e9c01fa95d2dd) (cherry picked from commit d09a3bf72c0b5f1779c52269671872368c99f02a) (cherry picked from commit 92709431b14df6c0687446247ac57cfc189ee827) (cherry picked from commit 418f026bd5a5084c1c4e2e91ad38051f6caa928c) (cherry picked from commit abe12d2f4ce31c3da0961b1b0a58df11f5a41e19) (cherry picked from commit 4e0e01bf6511c28212d7dff94fe131a502e13026) (cherry picked from commit d2c65a1c948648f11342274029a3f18b90aa58d2) Approved by: so Approved by: re (implicit) Security: FreeBSD-SA-23:15.stdio Sponsored by: The FreeBSD Foundation
Approved by: re (gjb) Reviewed by: mhorne, emaste, pauamma_gundo.com Sponsored by: Kumacom SAS Differential Revision: https://reviews.freebsd.org/D41109 (cherry picked from commit d952820105d6a2ad87ddf3bdc6c5fc5215d13b87) (cherry picked from commit 7c069dbe8e561436b4b2a0d6cf2c2483bd4e0fa3)
The man page had `kern.ktrace.geniosize` but the sysctl node contains an underscore. PR: 274274 Reported by: Ivan Rozhuk Sponsored by: The FreeBSD Foundation (cherry picked from commit a572dfa1bfe00cec93b27d8848ca49562cab5e3c) (cherry picked from commit 2fe06dda0a8abced5851188ed2cb76d1759efa19) Approved by: re (gjb)
- cast GETNEXT to unsigned where it is being promoted to int to prevent sign-extension (really it would have been better for PEEK*() and GETNEXT() to return unsigned char; this would have removed a ton of (uch) casts, but it is too intrusive for now). - fix an isalpha that should have been iswalpha PR: 264275, 274032 Reviewed by: kevans, eugen (previous version) Approved by: re (gjb) Obtained from: NetBSD (cherry picked from commit 3fb80f1476c7776f04ba7ef6d08397cef6abcfb0) (cherry picked from commit 56b09feb23d98fcd0c4aed8d4f907a5a2f6b5ea9)
Due to some bugs being found, back out the amd64 SIMD libc work from releng/14.0 ahead of the release and give these changes in a critical part of FreeBSD some more time to mature. This patch set backs out D40693, D41333, D41349, D41442, and D41697. Change sets D40729, D40730 (ffs), D41011 (bcmp integer overflow bug), and D41050 (rtld bits) are not backed out. The intent is for this backout to be a direct commit to releng/14.0 with the changes staying on CURRENT and stable/14. Sponsored by: The FreeBSD Foundation Requested by: imp kevans Approved by: kib, re (cperciva) Differential Revision: https://reviews.freebsd.org/D41855
MFC after: 3 days Reviewed by: andrew Differential Revision: https://reviews.freebsd.org/D41814 Approved by: re (delphij) (cherry picked from commit 88a9b6e1ed82b562f52bae26b3de257495cd1983) (cherry picked from commit c1335a776b0ff33a715bdaa2be59412006cb4053)
Approved by: re (cperciva) PR: 273480 Reviewed by: markj MFC after: 1 week (cherry picked from commit b7000cadfbf312b6a8acff6b7a3bbbbe55509565) (cherry picked from commit d0a5da5c1cf9c8d2c19b267e4db0fa2e28838f9d)
With the new simd-dispatch framework documented in simd(7), add cross-references to the new man pages to appropriate places. Sponsored by: The FreeBSD Foundation Approved by: emaste, re (gjb) MFC to: stable/14, releng/14.0 MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D41697 (cherry picked from commit d41afb814612ce005d93d2f8d127dcf6ea751cc4) (cherry picked from commit 7ec2ae8c7cd4400d5c0db690a1fe43cf85b6c5d3)
This adds specific width length modifiers in the form of wN and wfN (where N is 8, 16, 32, or 64) which allow printing intN_t and int_fastN_t without resorting to casts or PRI macros. Reviewed by: imp, emaste Differential Revision: https://reviews.freebsd.org/D41725 (cherry picked from commit bce0bef3c6abab92c7ac8cc23b7cc632a382721e) libc: Add test cases for N2680. This adds test cases for %wN and %wfN to the printf(3) and scanf(3) tests. While here, fix a few nits in the N2630 test cases. Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D41743 (cherry picked from commit 12b1c1e3fb446021a881d9815465137843fca50b) Approved by: re (gjb)
While here, also update a mention of ANSI C. Sponsored by: Klara, Inc. Reviewed by: kevans, markj Differential Revision: https://reviews.freebsd.org/D41686 (cherry picked from commit 5a57401e7106132b61b16e34365cebf52b773007) libc: Further nit in fopen(3) man page. Sponsored by: Klara, Inc. Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D41687 (cherry picked from commit c9f5889d05b5854be033849a4ff9985699071548) Approved by: re (gjb)