mirror of
https://git.yoctoproject.org/poky
synced 2026-03-18 13:19:42 +01:00
80aa68fa75
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose
arbitrary memory during a JSON.generate call. The issues lies in using
strdup in ext/json/ext/generator/generator.c, which will stop after
encountering a '\0' byte, returning a pointer to a string of length zero,
which is not the length stored in space_len.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-14064
Upstream patch:
8f782fd8e1
(From OE-Core rev: 17dbfd967019f9b50a9f6aa3f48cd3658fcccc70)
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
88 lines
2.9 KiB
Diff
88 lines
2.9 KiB
Diff
From 8f782fd8e181d9cfe9387ded43a5ca9692266b85 Mon Sep 17 00:00:00 2001
|
|
From: Florian Frank <flori@ping.de>
|
|
Date: Thu, 2 Mar 2017 12:12:33 +0100
|
|
Subject: [PATCH] Fix arbitrary heap exposure problem
|
|
|
|
Upstream-Status: Backport
|
|
CVE: CVE-2017-14064
|
|
|
|
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
|
|
---
|
|
ext/json/generator/generator.c | 12 ++++++------
|
|
ext/json/generator/generator.h | 1 -
|
|
2 files changed, 6 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/ext/json/generator/generator.c b/ext/json/generator/generator.c
|
|
index ef85bb7..c88818c 100644
|
|
--- a/ext/json/generator/generator.c
|
|
+++ b/ext/json/generator/generator.c
|
|
@@ -308,7 +308,7 @@ static char *fstrndup(const char *ptr, unsigned long len) {
|
|
char *result;
|
|
if (len <= 0) return NULL;
|
|
result = ALLOC_N(char, len);
|
|
- memccpy(result, ptr, 0, len);
|
|
+ memcpy(result, ptr, len);
|
|
return result;
|
|
}
|
|
|
|
@@ -1062,7 +1062,7 @@ static VALUE cState_indent_set(VALUE self, VALUE indent)
|
|
}
|
|
} else {
|
|
if (state->indent) ruby_xfree(state->indent);
|
|
- state->indent = strdup(RSTRING_PTR(indent));
|
|
+ state->indent = fstrndup(RSTRING_PTR(indent), len);
|
|
state->indent_len = len;
|
|
}
|
|
return Qnil;
|
|
@@ -1100,7 +1100,7 @@ static VALUE cState_space_set(VALUE self, VALUE space)
|
|
}
|
|
} else {
|
|
if (state->space) ruby_xfree(state->space);
|
|
- state->space = strdup(RSTRING_PTR(space));
|
|
+ state->space = fstrndup(RSTRING_PTR(space), len);
|
|
state->space_len = len;
|
|
}
|
|
return Qnil;
|
|
@@ -1136,7 +1136,7 @@ static VALUE cState_space_before_set(VALUE self, VALUE space_before)
|
|
}
|
|
} else {
|
|
if (state->space_before) ruby_xfree(state->space_before);
|
|
- state->space_before = strdup(RSTRING_PTR(space_before));
|
|
+ state->space_before = fstrndup(RSTRING_PTR(space_before), len);
|
|
state->space_before_len = len;
|
|
}
|
|
return Qnil;
|
|
@@ -1173,7 +1173,7 @@ static VALUE cState_object_nl_set(VALUE self, VALUE object_nl)
|
|
}
|
|
} else {
|
|
if (state->object_nl) ruby_xfree(state->object_nl);
|
|
- state->object_nl = strdup(RSTRING_PTR(object_nl));
|
|
+ state->object_nl = fstrndup(RSTRING_PTR(object_nl), len);
|
|
state->object_nl_len = len;
|
|
}
|
|
return Qnil;
|
|
@@ -1208,7 +1208,7 @@ static VALUE cState_array_nl_set(VALUE self, VALUE array_nl)
|
|
}
|
|
} else {
|
|
if (state->array_nl) ruby_xfree(state->array_nl);
|
|
- state->array_nl = strdup(RSTRING_PTR(array_nl));
|
|
+ state->array_nl = fstrndup(RSTRING_PTR(array_nl), len);
|
|
state->array_nl_len = len;
|
|
}
|
|
return Qnil;
|
|
diff --git a/ext/json/generator/generator.h b/ext/json/generator/generator.h
|
|
index 900b4d5..c367a62 100644
|
|
--- a/ext/json/generator/generator.h
|
|
+++ b/ext/json/generator/generator.h
|
|
@@ -1,7 +1,6 @@
|
|
#ifndef _GENERATOR_H_
|
|
#define _GENERATOR_H_
|
|
|
|
-#include <string.h>
|
|
#include <math.h>
|
|
#include <ctype.h>
|
|
|
|
--
|
|
2.10.2
|
|
|