mirror of
https://git.yoctoproject.org/poky
synced 2026-09-12 06:49:32 +02:00
binutils: fix CVE-2019-12972 CVE-2019-9071
(From OE-Core rev: 093f0914f261a27d58ecba9c1e9d3b78a35af012) (From OE-Core rev: 9422bf471953c8e548a369574d960791ceb28a24) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Anuj Mittal
committed by
Richard Purdie
Richard Purdie
parent
6d2e12e792
commit
552d3d8e1f
164
meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch
Normal file
164
meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch
Normal file
@@ -0,0 +1,164 @@
|
||||
From c1202057eb9161a86af27d867703235fee7b7555 Mon Sep 17 00:00:00 2001
|
||||
From: Nick Clifton <nickc@redhat.com>
|
||||
Date: Wed, 10 Apr 2019 15:49:36 +0100
|
||||
Subject: [PATCH] Pull in patch for libiberty that fixes a stack exhaustion bug
|
||||
when demangling a pathalogically constructed mangled name.
|
||||
|
||||
PR 89394
|
||||
* cp-demangle.c (cplus_demangle_fill_name): Reject negative
|
||||
lengths.
|
||||
(d_count_templates_scopes): Replace num_templates and num_scopes
|
||||
parameters with a struct d_print_info pointer parameter. Adjust
|
||||
body of the function accordingly. Add recursion counter and check
|
||||
that the recursion limit is not reached.
|
||||
(d_print_init): Pass dpi parameter to d_count_templates_scopes.
|
||||
Reset recursion counter afterwards, unless the recursion limit was
|
||||
reached.
|
||||
|
||||
CVE: CVE-2019-9071
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
|
||||
---
|
||||
ChangeLog | 16 ++++++++++++++
|
||||
libiberty/cp-demangle.c | 48 ++++++++++++++++++++++-------------------
|
||||
2 files changed, 42 insertions(+), 22 deletions(-)
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index cd631a15b6..4df3aaa62c 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,3 +1,19 @@
|
||||
+2019-04-10 Nick Clifton <nickc@redhat.com>
|
||||
+
|
||||
+ * libiberty: Sync with gcc. Bring in:
|
||||
+ 2019-04-10 Nick Clifton <nickc@redhat.com>
|
||||
+
|
||||
+ PR 89394
|
||||
+ * cp-demangle.c (cplus_demangle_fill_name): Reject negative
|
||||
+ lengths.
|
||||
+ (d_count_templates_scopes): Replace num_templates and num_scopes
|
||||
+ parameters with a struct d_print_info pointer parameter. Adjust
|
||||
+ body of the function accordingly. Add recursion counter and check
|
||||
+ that the recursion limit is not reached.
|
||||
+ (d_print_init): Pass dpi parameter to d_count_templates_scopes.
|
||||
+ Reset recursion counter afterwards, unless the recursion limit was
|
||||
+ reached.
|
||||
+
|
||||
2018-06-24 Nick Clifton <nickc@redhat.com>
|
||||
|
||||
2.32 branch created.
|
||||
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
|
||||
index b34b485692..779b4e763a 100644
|
||||
--- a/libiberty/cp-demangle.c
|
||||
+++ b/libiberty/cp-demangle.c
|
||||
@@ -861,7 +861,7 @@ CP_STATIC_IF_GLIBCPP_V3
|
||||
int
|
||||
cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
|
||||
{
|
||||
- if (p == NULL || s == NULL || len == 0)
|
||||
+ if (p == NULL || s == NULL || len <= 0)
|
||||
return 0;
|
||||
p->d_printing = 0;
|
||||
p->type = DEMANGLE_COMPONENT_NAME;
|
||||
@@ -4061,7 +4061,7 @@ d_growable_string_callback_adapter (const char *s, size_t l, void *opaque)
|
||||
are larger than the actual numbers encountered. */
|
||||
|
||||
static void
|
||||
-d_count_templates_scopes (int *num_templates, int *num_scopes,
|
||||
+d_count_templates_scopes (struct d_print_info *dpi,
|
||||
const struct demangle_component *dc)
|
||||
{
|
||||
if (dc == NULL)
|
||||
@@ -4081,13 +4081,13 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_TEMPLATE:
|
||||
- (*num_templates)++;
|
||||
+ dpi->num_copy_templates++;
|
||||
goto recurse_left_right;
|
||||
|
||||
case DEMANGLE_COMPONENT_REFERENCE:
|
||||
case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
|
||||
if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
|
||||
- (*num_scopes)++;
|
||||
+ dpi->num_saved_scopes++;
|
||||
goto recurse_left_right;
|
||||
|
||||
case DEMANGLE_COMPONENT_QUAL_NAME:
|
||||
@@ -4152,42 +4152,42 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
|
||||
case DEMANGLE_COMPONENT_TAGGED_NAME:
|
||||
case DEMANGLE_COMPONENT_CLONE:
|
||||
recurse_left_right:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- d_left (dc));
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- d_right (dc));
|
||||
+ /* PR 89394 - Check for too much recursion. */
|
||||
+ if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
|
||||
+ /* FIXME: There ought to be a way to report to the
|
||||
+ user that the recursion limit has been reached. */
|
||||
+ return;
|
||||
+
|
||||
+ ++ dpi->recursion;
|
||||
+ d_count_templates_scopes (dpi, d_left (dc));
|
||||
+ d_count_templates_scopes (dpi, d_right (dc));
|
||||
+ -- dpi->recursion;
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_CTOR:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- dc->u.s_ctor.name);
|
||||
+ d_count_templates_scopes (dpi, dc->u.s_ctor.name);
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_DTOR:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- dc->u.s_dtor.name);
|
||||
+ d_count_templates_scopes (dpi, dc->u.s_dtor.name);
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- dc->u.s_extended_operator.name);
|
||||
+ d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_FIXED_TYPE:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- dc->u.s_fixed.length);
|
||||
+ d_count_templates_scopes (dpi, dc->u.s_fixed.length);
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
|
||||
case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- d_left (dc));
|
||||
+ d_count_templates_scopes (dpi, d_left (dc));
|
||||
break;
|
||||
|
||||
case DEMANGLE_COMPONENT_LAMBDA:
|
||||
case DEMANGLE_COMPONENT_DEFAULT_ARG:
|
||||
- d_count_templates_scopes (num_templates, num_scopes,
|
||||
- dc->u.s_unary_num.sub);
|
||||
+ d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -4222,8 +4222,12 @@ d_print_init (struct d_print_info *dpi, demangle_callbackref callback,
|
||||
dpi->next_copy_template = 0;
|
||||
dpi->num_copy_templates = 0;
|
||||
|
||||
- d_count_templates_scopes (&dpi->num_copy_templates,
|
||||
- &dpi->num_saved_scopes, dc);
|
||||
+ d_count_templates_scopes (dpi, dc);
|
||||
+ /* If we did not reach the recursion limit, then reset the
|
||||
+ current recursion value back to 0, so that we can print
|
||||
+ the templates. */
|
||||
+ if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
|
||||
+ dpi->recursion = 0;
|
||||
dpi->num_copy_templates *= dpi->num_saved_scopes;
|
||||
|
||||
dpi->current_template = NULL;
|
||||
--
|
||||
2.20.1
|
||||
|
||||
Reference in New Issue
Block a user