helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-04-02 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

binutls: Security fix for CVE-2017-16827

Browse Source 
Affects: <= 2.29.1

(From OE-Core rev: 9fa2d818018420f3c9afc30012267e6a46fe1d09)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster 2018-08-06 19:52:12 -07:00 committed by Richard Purdie
parent aa7d33713c
commit 8073f5664b
2 changed files with 96 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.29.1.inc
View File

@ -53,6 +53,7 @@ SRC_URI = "\
file://CVE-2017-15939.patch \
file://CVE-2017-15996.patch \
file://CVE-2017-16826.patch \
file://CVE-2017-16827.patch \
"
S = "${WORKDIR}/git"

95
meta/recipes-devtools/binutils/binutils/CVE-2017-16827.patch Normal file
View File

@ -0,0 +1,95 @@
From 0301ce1486b1450f219202677f30d0fa97335419 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Tue, 17 Oct 2017 16:43:47 +1030
Subject: [PATCH] PR22306, Invalid free() in slurp_symtab()
PR 22306
* aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
and error for any other size that doesn't cover the header word.
Upstream-Status: Backport
Affects: <= 2.29.1
CVE: CVE-2017-16827
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 6 ++++++
bfd/aoutx.h | 45 ++++++++++++++++++++++++++++++---------------
2 files changed, 36 insertions(+), 15 deletions(-)
Index: git/bfd/aoutx.h
===================================================================
--- git.orig/bfd/aoutx.h
+++ git/bfd/aoutx.h
@@ -1352,27 +1352,42 @@ aout_get_external_symbols (bfd *abfd)
|| bfd_bread ((void *) string_chars, amt, abfd) != amt)
return FALSE;
stringsize = GET_WORD (abfd, string_chars);
+ if (stringsize == 0)
+ stringsize = 1;
+ else if (stringsize < BYTES_IN_WORD
+ || (size_t) stringsize != stringsize)
+ {
+ bfd_set_error (bfd_error_bad_value);
+ return FALSE;
+ }
#ifdef USE_MMAP
- if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
- &obj_aout_string_window (abfd), TRUE))
- return FALSE;
- strings = (char *) obj_aout_string_window (abfd).data;
-#else
- strings = (char *) bfd_malloc (stringsize + 1);
- if (strings == NULL)
- return FALSE;
-
- /* Skip space for the string count in the buffer for convenience
- when using indexes. */
- amt = stringsize - BYTES_IN_WORD;
- if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt)
+ if (stringsize >= BYTES_IN_WORD)
{
- free (strings);
- return FALSE;
+ if (! bfd_get_file_window (abfd, obj_str_filepos (abfd), stringsize,
+ &obj_aout_string_window (abfd), TRUE))
+ return FALSE;
+ strings = (char *) obj_aout_string_window (abfd).data;
}
+ else
#endif
+ {
+ strings = (char *) bfd_malloc (stringsize);
+ if (strings == NULL)
+ return FALSE;
+ if (stringsize >= BYTES_IN_WORD)
+ {
+ /* Keep the string count in the buffer for convenience
+ when indexing with e_strx. */
+ amt = stringsize - BYTES_IN_WORD;
+ if (bfd_bread (strings + BYTES_IN_WORD, amt, abfd) != amt)
+ {
+ free (strings);
+ return FALSE;
+ }
+ }
+ }
/* Ensure that a zero index yields an empty string. */
strings[0] = '\0';
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-17 Alan Modra <amodra@gmail.com>
+
+ PR 22306
+ * aoutx.h (aout_get_external_symbols): Handle stringsize of zero,
+ and error for any other size that doesn't cover the header word.
+
2017-11-01 Nick Clifton <nickc@redhat.com>
PR 22376