$OpenBSD: patch-src_os_pl-buffer_h,v 1.1 2013/01/08 13:36:47 jasper Exp $

From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Sun, 16 Dec 2012 18:13:17 +0100
Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code.

Pushes pointers on an automatic array without checking for overflow.
Can be used for DoS attacks.  Will be extremely hard to make it execute
arbitrary code.

Fixes CVE-2012-6089, patch from upstream:
http://www.swi-prolog.org/git/pl.git/commit/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c

--- src/os/pl-buffer.h.orig	Thu Sep 27 20:43:34 2012
+++ src/os/pl-buffer.h	Tue Jan  8 14:11:56 2013
@@ -101,6 +101,8 @@ f__allocFromBuffer(Buffer b, size_t bytes)
 				  sizeof((b)->static_buffer))
 #define emptyBuffer(b)           ((b)->top  = (b)->base)
 #define isEmptyBuffer(b)         ((b)->top == (b)->base)
+#define popBuffer(b,type) \
+	((b)->top -= sizeof(type), *(type*)(b)->top)
 
 #define discardBuffer(b) \
 	do \
