mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

nspr: Fix for CVE-2014-1545

Browse Source 
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote
attackers to execute arbitrary code or cause a denial of service
(out-of-bounds write) via vectors involving the sprintf and console
functions.Per: http://cwe.mitre.org/data/definitions/787.html

(From OE-Core rev: 191cab2f679491c2b6ddba49c5cf4886dcd22f57)

(From OE-Core rev: bebfeb6d4deac18601edda8dcac0f32c3382cb06)

Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Xufeng Zhang
2014-07-23 23:27:47 -04:00
committed by Richard Purdie
parent 4b1b580749
commit 0143097095
2 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
meta/recipes-support/nspr/nspr/nspr-CVE-2014-1545.patch Normal file
View File

@@ -0,0 +1,67 @@
Fix for CVE-2014-1545
Upstream-Status: Backport
Backported from nspr-4.10.6.tar.gz.
---
--- a/pr/src/io/prprf.c
+++ b/pr/src/io/prprf.c
@@ -50,6 +50,10 @@
#include "prlog.h"
#include "prmem.h"
+#ifdef _MSC_VER
+#define snprintf _snprintf
+#endif
+
/*
** WARNING: This code may *NOT* call PR_LOG (because PR_LOG calls it)
*/
@@ -330,7 +334,7 @@
** Convert a double precision floating point number into its printable
** form.
**
-** XXX stop using sprintf to convert floating point
+** XXX stop using snprintf to convert floating point
*/
static int cvt_f(SprintfState *ss, double d, const char *fmt0, const char *fmt1)
{
@@ -338,15 +342,14 @@
char fout[300];
int amount = fmt1 - fmt0;
- PR_ASSERT((amount > 0) && (amount < sizeof(fin)));
- if (amount >= sizeof(fin)) {
- /* Totally bogus % command to sprintf. Just ignore it */
+ if (amount <= 0 || amount >= sizeof(fin)) {
+ /* Totally bogus % command to snprintf. Just ignore it */
return 0;
}
memcpy(fin, fmt0, amount);
fin[amount] = 0;
- /* Convert floating point using the native sprintf code */
+ /* Convert floating point using the native snprintf code */
#ifdef DEBUG
{
const char *p = fin;
@@ -356,14 +359,11 @@
}
}
#endif
- sprintf(fout, fin, d);
-
- /*
- ** This assert will catch overflow's of fout, when building with
- ** debugging on. At least this way we can track down the evil piece
- ** of calling code and fix it!
- */
- PR_ASSERT(strlen(fout) < sizeof(fout));
+ memset(fout, 0, sizeof(fout));
+ snprintf(fout, sizeof(fout), fin, d);
+ /* Explicitly null-terminate fout because on Windows snprintf doesn't
+ * append a null-terminator if the buffer is too small. */
+ fout[sizeof(fout) - 1] = '\0';
return (*ss->stuff)(ss, fout, strlen(fout));
}

1
meta/recipes-support/nspr/nspr_4.10.3.bb
View File

@@ -9,6 +9,7 @@ SRC_URI = "ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v${PV}/src/nspr-$
file://remove-rpath-from-tests.patch \
file://fix-build-on-x86_64.patch \
file://trickly-fix-build-on-x86_64.patch \
file://nspr-CVE-2014-1545.patch \
"
SRC_URI += "file://nspr.pc.in"