|
| 1 | +Fixes CVE-2023-27477: https://nvd.nist.gov/vuln/detail/CVE-2023-27477, which is a |
| 2 | +vulnerability in cranelift that is exposed in rust. |
| 3 | + |
| 4 | +Adapted by [email protected] from patch to wasmtime/cranelift: |
| 5 | + https://github.com/bytecodealliance/wasmtime/commit/5dc2bbccbb363e474d2c9a1b8e38a89a43bbd5d1. |
| 6 | + |
| 7 | +From 5dc2bbccbb363e474d2c9a1b8e38a89a43bbd5d1 Mon Sep 17 00:00:00 2001 |
| 8 | +From: <redacted> |
| 9 | +Date: Wed, 8 Mar 2023 13:00:00 -0600 |
| 10 | +Subject: [PATCH] Merge pull request from GHSA-xm67-587q-r2vw |
| 11 | + |
| 12 | +This commit fixes an off-by-one error in the subtraction of indices when |
| 13 | +shuffling a vector with itself. Lanes 16-and-above are mapped to select |
| 14 | +from the first vector since the first and second element are the same, |
| 15 | +but the subtraction was with 15 rather than 16 by accident. |
| 16 | +--- |
| 17 | +PATCH NOTE -- ORIGINAL: |
| 18 | + cranelift/codegen/src/isa/x64/lower/isle.rs | 2 +- |
| 19 | +PATCH NOTE -- UPDATED: |
| 20 | + vendor/cranelift-codegen/src/isa/x64/lower/isle.rs | 2 +- |
| 21 | + |
| 22 | +PATCH NOTE: These clif files are not included in the rust source, so they are not included in the patch. |
| 23 | + .../filetests/isa/x64/simd-lane-access-compile.clif | 3 ++- |
| 24 | + cranelift/filetests/filetests/runtests/simd-shuffle.clif | 7 +++++++ |
| 25 | + |
| 26 | +PATCH NOTE -- ORIGINAL: |
| 27 | + 3 files changed, 10 insertions(+), 2 deletions(-) |
| 28 | +PATCH NOTE -- UPDATED: |
| 29 | + 1 file changed, 1 insertion(+), 1 deletion(-) |
| 30 | + |
| 31 | +# PATCH NOTE -- ORIGINAL: |
| 32 | +#diff --git a/cranelift/codegen/src/isa/x64/lower/isle.rs b/cranelift/codegen/src/isa/x64/lower/isle.rs |
| 33 | +# PATCH NOTE: UPDATED with path used within rust source: |
| 34 | +diff --git a/vendor/cranelift-codegen/src/isa/x64/lower/isle.rs b/vendor/cranelift-codegen/src/isa/x64/lower/isle.rs |
| 35 | + |
| 36 | +index 0267c3d32ce..61be54a0052 100644 |
| 37 | +# PATCH NOTE -- ORIGINAL: |
| 38 | +#--- a/cranelift/codegen/src/isa/x64/lower/isle.rs |
| 39 | +#+++ b/cranelift/codegen/src/isa/x64/lower/isle.rs |
| 40 | +# PATCH NOTE: UPDATED with path used within rust source: |
| 41 | +--- a/vendor/cranelift-codegen/src/isa/x64/lower/isle.rs |
| 42 | ++++ b/vendor/cranelift-codegen/src/isa/x64/lower/isle.rs |
| 43 | +@@ -752,7 +752,7 @@ impl Context for IsleContext<'_, '_, MInst, X64Backend> { |
| 44 | + fn shuffle_0_31_mask(&mut self, mask: &VecMask) -> VCodeConstant { |
| 45 | + let mask = mask |
| 46 | + .iter() |
| 47 | +- .map(|&b| if b > 15 { b.wrapping_sub(15) } else { b }) |
| 48 | ++ .map(|&b| if b > 15 { b.wrapping_sub(16) } else { b }) |
| 49 | + .map(|b| if b > 15 { 0b10000000 } else { b }) |
| 50 | + .collect(); |
| 51 | + self.lower_ctx |
| 52 | + |
| 53 | +# PATCH NOTE: The rest of the diffs are not applied because the tests are not included in the rust source. |
| 54 | +# diff --git a/cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif b/cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif |
| 55 | +# index f58cad93a64..f414054edb8 100644 |
| 56 | +# --- a/cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif |
| 57 | +# +++ b/cranelift/filetests/filetests/isa/x64/simd-lane-access-compile.clif |
| 58 | +# @@ -101,7 +101,8 @@ block0: |
| 59 | +# ; addb %al, (%rax) |
| 60 | +# ; addb %al, (%rax) |
| 61 | +# ; addb %al, (%rax) |
| 62 | +# -; addb %al, (%rcx, %rax) |
| 63 | +# +; addb %al, (%rbx) |
| 64 | +# +; addl %eax, (%rax) |
| 65 | +# ; addb %al, (%rax) |
| 66 | +# ; addb %al, (%rax) |
| 67 | +# ; addb %al, (%rax) |
| 68 | +# diff --git a/cranelift/filetests/filetests/runtests/simd-shuffle.clif b/cranelift/filetests/filetests/runtests/simd-shuffle.clif |
| 69 | +# index cbb8bef5aed..621eebda629 100644 |
| 70 | +# --- a/cranelift/filetests/filetests/runtests/simd-shuffle.clif |
| 71 | +# +++ b/cranelift/filetests/filetests/runtests/simd-shuffle.clif |
| 72 | +# @@ -19,3 +19,10 @@ block0(v0: i8x16, v1: i8x16): |
| 73 | +# return v2 |
| 74 | +# } |
| 75 | +# ; run: %shuffle_zeros([1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16], [17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32]) == [4 1 0 0 5 7 13 12 24 14 25 5 3 0 18 6] |
| 76 | +# + |
| 77 | +# +function %shuffle1(i8x16) -> i8x16 { |
| 78 | +# +block0(v0: i8x16): |
| 79 | +# + v1 = shuffle v0, v0, [8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23] |
| 80 | +# + return v1 |
| 81 | +# +} |
| 82 | +# +; run: %shuffle1([0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15]) == [8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7] |
0 commit comments