mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-25 06:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

binutls: Security fix CVE-2018-7643

Browse Source 
Affects <= 2.30

(From OE-Core rev: 70308a1133a3bd0e9d297bd66be4e05722484e7a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2018-08-05 21:53:37 -07:00
committed by Richard Purdie
parent b83fd9847f
commit b44ea09983
2 changed files with 103 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.30.inc
View File

@@ -36,6 +36,7 @@ SRC_URI = "\
file://0014-Detect-64-bit-MIPS-targets.patch \
file://0015-sync-with-OE-libtool-changes.patch \
file://CVE-2018-8945.patch \
file://CVE-2018-7643.patch \
"
S = "${WORKDIR}/git"

102
meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch Normal file
View File

@@ -0,0 +1,102 @@
From d11ae95ea3403559f052903ab053f43ad7821e37 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Thu, 1 Mar 2018 16:14:08 +0000
Subject: [PATCH] Prevent illegal memory accesses triggerd by intger overflow
when parsing corrupt DWARF information on a 32-bit host.
PR 22905
* dwarf.c (display_debug_ranges): Check that the offset loaded
from the range_entry structure is valid.
Upstream-Status: Backport
Affects: Binutils <= 2.30
CVE: CVE-2018-7643
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
binutils/ChangeLog | 6 ++++++
binutils/dwarf.c | 15 +++++++++++++++
2 files changed, 21 insertions(+)
Index: git/binutils/dwarf.c
===================================================================
--- git.orig/binutils/dwarf.c
+++ git/binutils/dwarf.c
@@ -387,6 +387,9 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Read AMOUNT bytes from PTR and store them in VAL as an unsigned value.
+ Checks to make sure that the read will not reach or pass END
+ and that VAL is big enough to hold AMOUNT bytes. */
#define SAFE_BYTE_GET(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -415,6 +418,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_BYTE_GET, but also increments PTR by AMOUNT. */
#define SAFE_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -423,6 +427,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_BYTE_GET, but reads a signed value. */
#define SAFE_SIGNED_BYTE_GET(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -441,6 +446,7 @@ read_uleb128 (unsigned char * data,
} \
while (0)
+/* Like SAFE_SIGNED_BYTE_GET, but also increments PTR by AMOUNT. */
#define SAFE_SIGNED_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \
do \
{ \
@@ -6543,6 +6549,7 @@ display_debug_ranges_list (unsigned char
break;
SAFE_SIGNED_BYTE_GET_AND_INC (end, start, pointer_size, finish);
+
printf (" %8.8lx ", offset);
if (begin == 0 && end == 0)
@@ -6810,6 +6817,13 @@ display_debug_ranges (struct dwarf_secti
continue;
}
+ if (next < section_begin || next >= finish)
+ {
+ warn (_("Corrupt offset (%#8.8lx) in range entry %u\n"),
+ (unsigned long) offset, i);
+ continue;
+ }
+
if (dwarf_check != 0 && i > 0)
{
if (start < next)
@@ -6825,6 +6839,7 @@ display_debug_ranges (struct dwarf_secti
(unsigned long) (next - section_begin), section->name);
}
}
+
start = next;
last_start = next;
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-03-01 Nick Clifton <nickc@redhat.com>
+
+ PR 22905
+ * dwarf.c (display_debug_ranges): Check that the offset loaded
+ from the range_entry structure is valid.
+
2018-05-08 Nick Clifton <nickc@redhat.com>
PR 22809