mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

e2fsprogs: CVE-2015-0247

Browse Source 
Fixes input sanitization errors.

References
http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4
http://www.ocert.org/advisories/ocert-2015-002.html

(From OE-Core rev: f3e5b052689b2eba30e26903e964791f92241e65)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Sona Sarmadi
2015-04-29 11:02:22 +02:00
committed by Richard Purdie
parent b9da1f441b
commit 90a33dde44
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2015-0247.patch Normal file
View File

@@ -0,0 +1,58 @@
From f66e6ce4446738c2c7f43d41988a3eb73347e2f5 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Sat, 9 Aug 2014 12:24:54 -0400
Subject: libext2fs: avoid buffer overflow if s_first_meta_bg is too big
If s_first_meta_bg is greater than the of number block group
descriptor blocks, then reading or writing the block group descriptors
will end up overruning the memory buffer allocated for the
descriptors. Fix this by limiting first_meta_bg to no more than
fs->desc_blocks. This doesn't correct the bad s_first_meta_bg value,
but it avoids causing the e2fsprogs userspace programs from
potentially crashing.
Fixes CVE-2015-0247
Upstream-Status: Backport
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
index 4599eef..1f99113 100644
--- a/lib/ext2fs/closefs.c
+++ b/lib/ext2fs/closefs.c
@@ -344,9 +344,11 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
* superblocks and group descriptors.
*/
group_ptr = (char *) group_shadow;
- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
old_desc_blocks = fs->super->s_first_meta_bg;
- else
+ if (old_desc_blocks > fs->super->s_first_meta_bg)
+ old_desc_blocks = fs->desc_blocks;
+ } else
old_desc_blocks = fs->desc_blocks;
ext2fs_numeric_progress_init(fs, &progress, NULL,
diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
index a1a3517..ba501e6 100644
--- a/lib/ext2fs/openfs.c
+++ b/lib/ext2fs/openfs.c
@@ -378,9 +378,11 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
#ifdef WORDS_BIGENDIAN
groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
#endif
- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
first_meta_bg = fs->super->s_first_meta_bg;
- else
+ if (first_meta_bg > fs->desc_blocks)
+ first_meta_bg = fs->desc_blocks;
+ } else
first_meta_bg = fs->desc_blocks;
if (first_meta_bg) {
retval = io_channel_read_blk(fs->io, group_block +
--
cgit v0.10.2

1
meta/recipes-devtools/e2fsprogs/e2fsprogs_1.42.9.bb
View File

@@ -18,6 +18,7 @@ SRC_URI += "file://acinclude.m4 \
file://0011-mke2fs.8.in-update-the-manual-for-the-d-option.patch \
file://0001-e2fsprogs-fix-cross-compilation-problem.patch \
file://misc-mke2fs.c-return-error-when-failed-to-populate-fs.patch \
file://CVE-2015-0247.patch \
"
SRC_URI[md5sum] = "3f8e41e63b432ba114b33f58674563f7"