[beignet] 04/09: Fix another printf bug

[Rebecca Palmer]

This is an automated email from the git hooks/post-receive script.

rnpalmer-guest pushed a commit to branch master
in repository beignet.

commit a9f78945480c233265eb766f01f2df6557a00cb9
Author: Rebecca N. Palmer <rebecca_palmer at zoho.com>
Date:   Mon Nov 9 22:03:52 2015 +0000

    Fix another printf bug
---
 debian/changelog                 |  2 +-
 debian/patches/printf-fix2.patch | 26 ++++++++++++++++++++++++++
 debian/patches/series            |  1 +
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/debian/changelog b/debian/changelog
index 7f3f610..b31ca5a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,7 +2,7 @@ beignet (1.1.1-2) UNRELEASED; urgency=medium
 
   * Add patches to support LLVM 3.6/3.7,
     use system default version. (Closes: #803643)
-  * Fix a printf bug.
+  * Fix two printf bugs.
 
  -- Rebecca N. Palmer <rebecca_palmer at zoho.com>  Mon, 09 Nov 2015 21:47:04 +0000
 
diff --git a/debian/patches/printf-fix2.patch b/debian/patches/printf-fix2.patch
new file mode 100644
index 0000000..b2d7ef7
--- /dev/null
+++ b/debian/patches/printf-fix2.patch
@@ -0,0 +1,26 @@
+Description: GBE: Don't read past end of printf format string
+
+When p == end (the null terminator byte), don't try to read p + 1:
+as this is outside the string, it might be a '%' from a different
+object (causing __parse_printf_state(end + 2, end, ...) to be called,
+which will fail), or an invalid address.
+
+Accepted upstream as
+http://cgit.freedesktop.org/beignet/commit/?id=7825653733459c1fcde7986d094c9e9218ee2c98
+
+Author: "Rebecca N. Palmer" <rebecca_palmer at zoho.com>
+
+diff --git a/backend/src/llvm/llvm_printf_parser.cpp b/backend/src/llvm/llvm_printf_parser.cpp
+index bdaed8a..e2adcd8 100644
+--- a/backend/src/llvm/llvm_printf_parser.cpp
++++ b/backend/src/llvm/llvm_printf_parser.cpp
+@@ -229,7 +229,7 @@ again:
+         printf("string end with %%\n");
+         goto error;
+       }
+-      if (*(p + 1) == '%') { // %%
++      if (p + 1 < end && *(p + 1) == '%') { // %%
+         p += 2;
+         goto again;
+       }
+
diff --git a/debian/patches/series b/debian/patches/series
index d1ed421..bfc2c8f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@ allow-+-in-directory.patch
 llvm-36-convert-bug.patch
 llvm-37-support.patch
 printf-fix-90472.patch
+printf-fix2.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-opencl/beignet.git