mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-19 15:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

binutls: Security fix CVE-2017-14933

Browse Source 
Affects: <= 2.29.1

(From OE-Core rev: 16cdbc7504cc14547bb99ed742484ae9e658ec6e)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2018-08-06 14:02:09 -07:00
committed by Richard Purdie
parent 4ad8bd4a60
commit 9be7b4f3db
3 changed files with 162 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-devtools/binutils/binutils-2.29.1.inc
View File

@@ -38,6 +38,8 @@ SRC_URI = "\
file://CVE-2017-17124.patch \
file://CVE-2017-14930.patch \
file://CVE-2017-14932.patch \
file://CVE-2017-14933_p1.patch \
file://CVE-2017-14933_p2.patch \
"
S = "${WORKDIR}/git"

58
meta/recipes-devtools/binutils/binutils/CVE-2017-14933_p1.patch Normal file
View File

@@ -0,0 +1,58 @@
From 30d0157a2ad64e64e5ff9fcc0dbe78a3e682f573 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Tue, 26 Sep 2017 14:37:47 +0100
Subject: [PATCH] Avoid needless resource usage when processing a corrupt DWARF
directory or file name table.
PR 22210
* dwarf2.c (read_formatted_entries): Fail early if we know that
the loop parsing data entries will overflow the end of the
section.
Upstream-Status: Backport
Affects: <= 2.29.1
CVE: CVE-2017-14933 #1
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 7 +++++++
bfd/dwarf2.c | 10 ++++++++++
2 files changed, 17 insertions(+)
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,10 @@
+2017-09-26 Nick Clifton <nickc@redhat.com>
+
+ PR 22210
+ * dwarf2.c (read_formatted_entries): Fail early if we know that
+ the loop parsing data entries will overflow the end of the
+ section.
+
2017-09-26 Alan Modra <amodra@gmail.com>
PR 22204
Index: git/bfd/dwarf2.c
===================================================================
--- git.orig/bfd/dwarf2.c
+++ git/bfd/dwarf2.c
@@ -1933,6 +1933,17 @@ read_formatted_entries (struct comp_unit
data_count = _bfd_safe_read_leb128 (abfd, buf, &bytes_read, FALSE, buf_end);
buf += bytes_read;
+
+ /* PR 22210. Paranoia check. Don't bother running the loop
+ if we know that we are going to run out of buffer. */
+ if (data_count > (bfd_vma) (buf_end - buf))
+ {
+ _bfd_error_handler (_("Dwarf Error: data count (%Lx) larger than buffer size."),
+ data_count);
+ bfd_set_error (bfd_error_bad_value);
+ return FALSE;
+ }
+
for (datai = 0; datai < data_count; datai++)
{
bfd_byte *format = format_header_data;

102
meta/recipes-devtools/binutils/binutils/CVE-2017-14933_p2.patch Normal file
View File

@@ -0,0 +1,102 @@
From 33e0a9a056bd23e923b929a4f2ab049ade0b1c32 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Tue, 26 Sep 2017 23:20:06 +0930
Subject: [PATCH] Tidy reading data in read_formatted_entries
Using read_attribute_value accomplishes two things: It checks for
unexpected formats, and ensures the buffer pointer always increments.
PR 22210
* dwarf2.c (read_formatted_entries): Use read_attribute_value to
read data.
Upstream-Status: Backport
Affects: <= 2.29.1
CVE: CVE-2017-14933 #2
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 6 ++++++
bfd/dwarf2.c | 37 +++++++------------------------------
2 files changed, 13 insertions(+), 30 deletions(-)
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2017-09-26 Alan Modra <amodra@gmail.com>
+
+ PR 22210
+ * dwarf2.c (read_formatted_entries): Use read_attribute_value to
+ read data.
+
2017-09-26 Nick Clifton <nickc@redhat.com>
PR 22210
Index: git/bfd/dwarf2.c
===================================================================
--- git.orig/bfd/dwarf2.c
+++ git/bfd/dwarf2.c
@@ -1955,6 +1955,7 @@ read_formatted_entries (struct comp_unit
char *string_trash;
char **stringp = &string_trash;
unsigned int uint_trash, *uintp = &uint_trash;
+ struct attribute attr;
content_type = _bfd_safe_read_leb128 (abfd, format, &bytes_read,
FALSE, buf_end);
@@ -1986,47 +1987,23 @@ read_formatted_entries (struct comp_unit
form = _bfd_safe_read_leb128 (abfd, format, &bytes_read, FALSE,
buf_end);
format += bytes_read;
+
+ buf = read_attribute_value (&attr, form, 0, unit, buf, buf_end);
+ if (buf == NULL)
+ return FALSE;
switch (form)
{
case DW_FORM_string:
- *stringp = read_string (abfd, buf, buf_end, &bytes_read);
- buf += bytes_read;
- break;
-
case DW_FORM_line_strp:
- *stringp = read_indirect_line_string (unit, buf, buf_end, &bytes_read);
- buf += bytes_read;
+ *stringp = attr.u.str;
break;
case DW_FORM_data1:
- *uintp = read_1_byte (abfd, buf, buf_end);
- buf += 1;
- break;
-
case DW_FORM_data2:
- *uintp = read_2_bytes (abfd, buf, buf_end);
- buf += 2;
- break;
-
case DW_FORM_data4:
- *uintp = read_4_bytes (abfd, buf, buf_end);
- buf += 4;
- break;
-
case DW_FORM_data8:
- *uintp = read_8_bytes (abfd, buf, buf_end);
- buf += 8;
- break;
-
case DW_FORM_udata:
- *uintp = _bfd_safe_read_leb128 (abfd, buf, &bytes_read, FALSE,
- buf_end);
- buf += bytes_read;
- break;
-
- case DW_FORM_block:
- /* It is valid only for DW_LNCT_timestamp which is ignored by
- current GDB. */
+ *uintp = attr.u.val;
break;
}
}