CVE-2016-6560: Improper Input Validation (CWE-20)
value: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.6
Published: 2017-03-31T19:59Z
Repository: https://github.com/illumos/illumos-gate
Language: Other
Files changed: usr/src/uts/intel/ia32/ml/copy.s
Commit date: 2016-10-21 11:57:39 -0700
Commit message: 7488 bcopy and bzero should mind signed bits
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Reviewed by: Patrick Mooney <patrick.mooney@joyent.com>
Approved by: Richard Lowe <richlowe@richlowe.net>

Diff: diff --git a/usr/src/uts/intel/ia32/ml/copy.s b/usr/src/uts/intel/ia32/ml/copy.s
index 35414743a9..7593de374e 100644
--- a/usr/src/uts/intel/ia32/ml/copy.s
+++ b/usr/src/uts/intel/ia32/ml/copy.s
@@ -34,11 +34,11 @@
 
 /*       Copyright (c) 1987, 1988 Microsoft Corporation			*/
 /*         All Rights Reserved						*/
 
 /*
- * Copyright 2015 Joyent, Inc.
+ * Copyright 2016 Joyent, Inc.
  */
 
 #include <sys/errno.h>
 #include <sys/asm_linkage.h>
 
@@ -468,11 +468,11 @@ bcopy(const void *from, void *to, size_t count)
 	 */
 	ALTENTRY(bcopy_altentry)
 do_copy:
 #define	L(s) .bcopy/**/s
 	cmpq	$0x50, %rdx		/* 80 */
-	jge	bcopy_ck_size
+	jae	bcopy_ck_size
 
 	/*
 	 * Performance data shows many caller's copy small buffers. So for
 	 * best perf for these sizes unrolled code is used. Store data without
 	 * worrying about alignment.
@@ -867,11 +867,11 @@ bcopy_patch_end:
 
 	.p2align 4
 	.globl bcopy_ck_size
 bcopy_ck_size:
 	cmpq	$BCOPY_DFLT_REP, %rdx
-	jge	L(use_rep)
+	jae	L(use_rep)
 
 	/*
 	 * Align to a 8-byte boundary. Avoids penalties from unaligned stores
 	 * as well as from stores spanning cachelines.
 	 */
@@ -925,11 +925,11 @@ L(aligned_loop):
 	mov	0x38(%rdi), %r10
 	lea	0x40(%rdi), %rdi
 	mov	%r8, 0x30(%rsi)
 	mov	%r10, 0x38(%rsi)
 	lea	0x40(%rsi), %rsi
-	jge	L(aligned_loop)
+	jae	L(aligned_loop)
 
 	/*
 	 * Copy remaining bytes (0-63)
 	 */
 L(do_remainder):
@@ -1156,11 +1156,11 @@ bzero(void *addr, size_t count)
 do_zero:
 #define	L(s) .bzero/**/s
 	xorl	%eax, %eax
 
 	cmpq	$0x50, %rsi		/* 80 */
-	jge	L(ck_align)
+	jae	L(ck_align)
 
 	/*
 	 * Performance data shows many caller's are zeroing small buffers. So
 	 * for best perf for these sizes unrolled code is used. Store zeros
 	 * without worrying about alignment.
@@ -1410,11 +1410,11 @@ L(ck_align):
 	 * Transition point determined experimentally as measured on
 	 * Intel Xeon processors (incl. Nehalem) and AMD Opteron.
 	 */
 L(aligned_now):
 	cmp	$BZERO_USE_REP, %rsi
-	jg	L(use_rep)
+	ja	L(use_rep)
 
 	/*
 	 * zero 64-bytes per loop
 	 */
 	.p2align 4
@@ -1428,11 +1428,11 @@ L(bzero_loop):
 	movq	%rax, 0x20(%rdi) 
 	movq	%rax, 0x28(%rdi) 
 	movq	%rax, 0x30(%rdi) 
 	movq	%rax, 0x38(%rdi) 
 	leaq	0x40(%rdi), %rdi
-	jge	L(bzero_loop)
+	jae	L(bzero_loop)
 
 	/*
 	 * Clear any remaining bytes..
 	 */
 9:

Vulnerable code:  * Copyright 2015 Joyent, Inc.
	jge	bcopy_ck_size
	jge	L(use_rep)
	jge	L(aligned_loop)
	jge	L(ck_align)
	jg	L(use_rep)
	jge	L(bzero_loop)
Fixed code:  * Copyright 2016 Joyent, Inc.
	jae	bcopy_ck_size
	jae	L(use_rep)
	jae	L(aligned_loop)
	jae	L(ck_align)
	ja	L(use_rep)
	jae	L(bzero_loop)