helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-04-02 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

binutls: Security fix for CVE-2017-16831

Browse Source 
Affects: <= 2.29.1

(From OE-Core rev: ab9e8161a3b89914d8664175a684675bc99d6f21)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster 2018-08-07 16:16:58 -07:00 committed by Richard Purdie
parent 7d51055f44
commit d40d4bf86f
2 changed files with 78 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.29.1.inc
View File

@ -58,6 +58,7 @@ SRC_URI = "\
file://CVE-2017-16828_p2.patch \
file://CVE-2017-16829.patch \
file://CVE-2017-16830.patch \
file://CVE-2017-16831.patch \
"
S = "${WORKDIR}/git"

77
meta/recipes-devtools/binutils/binutils/CVE-2017-16831.patch Normal file
View File

@ -0,0 +1,77 @@
From 6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Fri, 3 Nov 2017 11:55:21 +0000
Subject: [PATCH] Fix excessive memory allocation attempts and possible integer
overfloaws when attempting to read a COFF binary with a corrupt symbol count.
PR 22385
* coffgen.c (_bfd_coff_get_external_symbols): Check for an
overlarge raw syment count.
(coff_get_normalized_symtab): Likewise.
Upstream-Status: Backport
Affects: <= 2.29.1
CVE: CVE-2017-16831
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 8 ++++++++
bfd/coffgen.c | 17 +++++++++++++++--
2 files changed, 23 insertions(+), 2 deletions(-)
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,11 @@
+2017-11-03 Mingi Cho <mgcho.minic@gmail.com>
+ Nick Clifton <nickc@redhat.com>
+
+ PR 22385
+ * coffgen.c (_bfd_coff_get_external_symbols): Check for an
+ overlarge raw syment count.
+ (coff_get_normalized_symtab): Likewise.
+
2017-10-17 Alan Modra <amodra@gmail.com>
PR 22307
Index: git/bfd/coffgen.c
===================================================================
--- git.orig/bfd/coffgen.c
+++ git/bfd/coffgen.c
@@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abf
size = obj_raw_syment_count (abfd) * symesz;
if (size == 0)
return TRUE;
+ /* Check for integer overflow and for unreasonable symbol counts. */
+ if (size < obj_raw_syment_count (abfd)
+ || (bfd_get_file_size (abfd) > 0
+ && size > bfd_get_file_size (abfd)))
+
+ {
+ _bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
+ abfd, obj_raw_syment_count (abfd));
+ return FALSE;
+ }
syms = bfd_malloc (size);
if (syms == NULL)
{
/* PR 21013: Provide an error message when the alloc fails. */
- _bfd_error_handler (_("%B: Not enough memory to allocate space for %lu symbols"),
- abfd, size);
+ _bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
+ abfd, obj_raw_syment_count (abfd), symesz);
return FALSE;
}
@@ -1790,6 +1800,9 @@ coff_get_normalized_symtab (bfd *abfd)
return NULL;
size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
+ /* Check for integer overflow. */
+ if (size < obj_raw_syment_count (abfd))
+ return NULL;
internal = (combined_entry_type *) bfd_zalloc (abfd, size);
if (internal == NULL && size != 0)
return NULL;