[src/trunk]: src/external/lgpl3/gmp/dist/mpz gmp: pullover fixes for https://...

[mrg <mrg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a6d5ed409863
branches:  trunk
changeset: 1026567:a6d5ed409863
user:      mrg <mrg%NetBSD.org@localhost>
date:      Mon Nov 29 03:57:22 2021 +0000

description:
gmp: pullover fixes for https://nvd.nist.gov/vuln/detail/CVE-2021-43618

changeset 18135:561a9c25298e

mpz/inp_raw.c: Avoid bit size overflows
author  Marco Bodrato <bodrato%mail.dm.unipi.it@localhost>


XXX: pullup-8, pullup-9

diffstat:

 external/lgpl3/gmp/dist/mpz/inp_raw.c |  5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diffs (16 lines):

diff -r c107c2a8b250 -r a6d5ed409863 external/lgpl3/gmp/dist/mpz/inp_raw.c
--- a/external/lgpl3/gmp/dist/mpz/inp_raw.c     Mon Nov 29 00:17:10 2021 +0000
+++ b/external/lgpl3/gmp/dist/mpz/inp_raw.c     Mon Nov 29 03:57:22 2021 +0000
@@ -88,8 +88,11 @@
 
   abs_csize = ABS (csize);
 
+  if (UNLIKELY (abs_csize > ~(mp_bitcnt_t) 0 / 8))
+    return 0; /* Bit size overflows */
+
   /* round up to a multiple of limbs */
-  abs_xsize = BITS_TO_LIMBS (abs_csize*8);
+  abs_xsize = BITS_TO_LIMBS ((mp_bitcnt_t) abs_csize * 8);
 
   if (abs_xsize != 0)
     {