Control: tags 757037 + patch pending
I've prepared an NMU for lzo2 (versioned as 2.08-1.1) based on
feedback on debian-devel and further testing, and
uploaded it to DELAYED/7. Please feel free to tell me if I
should delay it longer.
This has the same performance as 2.08-1 on amd64, and builds / passes
tests / works in OpenVPN on a Marvell Kirkwood (arm5vtel) CPU
running in Debian's default configuration, which previously exhibited
this bug when using or rebuilding 2.08-1.
Regards,
S
diffstat for lzo2-2.08 lzo2-2.08
changelog | 9 +
patches/0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch | 51 ++++++++++
patches/series | 1
3 files changed, 61 insertions(+)
diff -Nru lzo2-2.08/debian/changelog lzo2-2.08/debian/changelog
--- lzo2-2.08/debian/changelog 2014-07-15 02:03:18.000000000 +0100
+++ lzo2-2.08/debian/changelog 2014-11-23 18:04:41.000000000 +0000
@@ -1,3 +1,12 @@
+lzo2 (2.08-1.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Avoid generating unaligned accesses via assigning one
+ struct { char[n] } to another, on platforms where unaligned
+ accesses are not known to be OK (Closes: #757037)
+
+ -- Simon McVittie <s...@debian.org> Sun, 23 Nov 2014 15:53:09 +0000
+
lzo2 (2.08-1) unstable; urgency=low
* New upstream release (closes: #752861) (CVE-2014-4607)
diff -Nru lzo2-2.08/debian/patches/0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch lzo2-2.08/debian/patches/0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch
--- lzo2-2.08/debian/patches/0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch 1970-01-01 01:00:00.000000000 +0100
+++ lzo2-2.08/debian/patches/0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch 2014-11-23 18:04:41.000000000 +0000
@@ -0,0 +1,51 @@
+From: Simon McVittie <s...@debian.org>
+Date: Sun, 23 Nov 2014 18:04:25 +0000
+Subject: Do not cast to struct { char[n] } for potentially unaligned accesses
+
+Not defining __lzo_memops_tcheck results in that code path being
+skipped, falling back to byte-by-byte access.
+
+Bug-Debian: https://bugs.debian.org/757037
+---
+ minilzo/minilzo.c | 5 +++++
+ src/lzo_func.h | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/minilzo/minilzo.c b/minilzo/minilzo.c
+index ab2be5f..df8b1e4 100644
+--- a/minilzo/minilzo.c
++++ b/minilzo/minilzo.c
+@@ -3355,9 +3355,14 @@ lzo_bitops_unused_funcs(void)
+ }
+
+ #if defined(__lzo_alignof) && !(LZO_CFG_NO_UNALIGNED)
++/* this check for required alignment == 1 does not seem to be sufficient
++ * to avoid gcc 4.9 on Debian using access patterns that assume alignment,
++ * see https://bugs.debian.org/757037 */
++#if 0
+ #ifndef __lzo_memops_tcheck
+ #define __lzo_memops_tcheck(t,a,b) ((void)0, sizeof(t) == (a) && __lzo_alignof(t) == (b))
+ #endif
++#endif /* #if 0 */
+ #endif
+ #ifndef lzo_memops_TU0p
+ #define lzo_memops_TU0p void __LZO_MMODEL *
+diff --git a/src/lzo_func.h b/src/lzo_func.h
+index dfaa676..60e319a 100644
+--- a/src/lzo_func.h
++++ b/src/lzo_func.h
+@@ -165,9 +165,14 @@ lzo_bitops_unused_funcs(void)
+ ************************************************************************/
+
+ #if defined(__lzo_alignof) && !(LZO_CFG_NO_UNALIGNED)
++/* this check for required alignment == 1 does not seem to be sufficient
++ * to avoid gcc 4.9 on Debian using access patterns that assume alignment,
++ * see https://bugs.debian.org/757037 */
++#if 0
+ #ifndef __lzo_memops_tcheck
+ #define __lzo_memops_tcheck(t,a,b) ((void)0, sizeof(t) == (a) && __lzo_alignof(t) == (b))
+ #endif
++#endif /* #if 0 */
+ #endif
+ #ifndef lzo_memops_TU0p
+ #define lzo_memops_TU0p void __LZO_MMODEL *
diff -Nru lzo2-2.08/debian/patches/series lzo2-2.08/debian/patches/series
--- lzo2-2.08/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ lzo2-2.08/debian/patches/series 2014-11-23 18:04:41.000000000 +0000
@@ -0,0 +1 @@
+0001-Do-not-cast-to-struct-char-n-for-potentially-unalign.patch
