[Bug other/54411] libiberty: objalloc_alloc integer overflows (CVE-2012-3509)

[fw at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411

--- Comment #5 from Florian Weimer <fw at gcc dot gnu.org> 2012-09-18 08:34:12 
UTC ---
Author: fw
Date: Tue Sep 18 08:34:05 2012
New Revision: 191413

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=191413
Log:
PR other/54411: integer overflow in objalloc_alloc

2012-09-18  Florian Weimer  <fwei...@redhat.com>

    PR other/54411
    * objalloc.h (objalloc_alloc): Do not use fast path on wraparound.

2012-09-18  Florian Weimer  <fwei...@redhat.com>

    PR other/54411
    * objalloc.c (_objalloc_alloc): Add overflow check covering
    alignment and CHUNK_HEADER_SIZE addition.

Modified:
    trunk/include/ChangeLog
    trunk/include/objalloc.h
    trunk/libiberty/ChangeLog
    trunk/libiberty/objalloc.c