mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-06 08:48:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

python2: Security fix CVE-2016-5636

Browse Source 
Affects python2 < 2.7.11
Base score (4.4) Medium

(From OE-Core rev: 4d1f651047a045955b436357753c7e094468b4ed)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2016-07-16 16:04:14 -07:00
committed by Richard Purdie
parent 3aaf023202
commit 81106cd333
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
meta/recipes-devtools/python/python/CVE-2016-5636.patch Normal file
View File

@@ -0,0 +1,44 @@
# HG changeset patch
# User Benjamin Peterson <benjamin@python.org>
# Date 1453357424 28800
# Node ID 985fc64c60d6adffd1138b6cc46df388ca91ca5d
# Parent 7ec954b9fc54448a35b56d271340ba109eb381b9
prevent buffer overflow in get_data (closes #26171)
Upstream-Status: Backport
https://hg.python.org/cpython/rev/985fc64c60d6
CVE: CVE-2016-5636
Signed-off-by: Armin Kuster <akuster@mvista.com>
Index: Python-2.7.11/Misc/NEWS
===================================================================
--- Python-2.7.11.orig/Misc/NEWS
+++ Python-2.7.11/Misc/NEWS
@@ -7,6 +7,9 @@ What's New in Python 2.7.11?
*Release date: 2015-12-05*
+- Issue #26171: Fix possible integer overflow and heap corruption in
+ zipimporter.get_data().
+
Library
-------
Index: Python-2.7.11/Modules/zipimport.c
===================================================================
--- Python-2.7.11.orig/Modules/zipimport.c
+++ Python-2.7.11/Modules/zipimport.c
@@ -895,6 +895,11 @@ get_data(char *archive, PyObject *toc_en
PyMarshal_ReadShortFromFile(fp); /* local header size */
file_offset += l; /* Start of file data */
+ if (data_size > LONG_MAX - 1) {
+ fclose(fp);
+ PyErr_NoMemory();
+ return NULL;
+ }
raw_data = PyString_FromStringAndSize((char *)NULL, compress == 0 ?
data_size : data_size + 1);
if (raw_data == NULL) {