aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2019-05-26 07:22:17 -0700
committerArmin Kuster <akuster@mvista.com>2019-05-26 07:22:17 -0700
commit3103f407ff0c579c7e5887fd925d52d5c92c83f9 (patch)
treeaa3718459acb488278a75fc05caf211c2cb3c75b
parentf162d5bfe6eaeca24f441c83c87252c8d05744fc (diff)
downloadopenembedded-core-contrib-stable/thud-next.tar.gz
openembedded-core-contrib-stable/thud-next.tar.bz2
openembedded-core-contrib-stable/thud-next.zip
glibc: Security fix CVE-2019-9169stable/thud-next
Signed-off-by: Armin Kuster <akuster@mvista.com>
-rw-r--r--meta/recipes-core/glibc/glibc/CVE-2019-9169.patch63
-rw-r--r--meta/recipes-core/glibc/glibc_2.28.bb1
2 files changed, 64 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2019-9169.patch b/meta/recipes-core/glibc/glibc/CVE-2019-9169.patch
new file mode 100644
index 0000000000..14cfaa35af
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2019-9169.patch
@@ -0,0 +1,63 @@
+From 583dd860d5b833037175247230a328f0050dbfe9 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Mon, 21 Jan 2019 11:08:13 -0800
+Subject: [PATCH] regex: fix read overrun [BZ #24114]
+
+Problem found by AddressSanitizer, reported by Hongxu Chen in:
+https://debbugs.gnu.org/34140
+* posix/regexec.c (proceed_next_node):
+Do not read past end of input buffer.
+
+Upstream-Status: Backport
+https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9
+
+CVE: CVE-2019-9169
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ ChangeLog | 10 +++++++++-
+ posix/regexec.c | 6 ++++--
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+Index: git/ChangeLog
+===================================================================
+--- git.orig/ChangeLog
++++ git/ChangeLog
+@@ -1,3 +1,11 @@
++2019-01-31 Paul Eggert <eggert@cs.ucla.edu>
++
++ regex: fix read overrun [BZ #24114]
++ Problem found by AddressSanitizer, reported by Hongxu Chen in:
++ https://debbugs.gnu.org/34140
++ * posix/regexec.c (proceed_next_node):
++ Do not read past end of input buffer.
++
+ 2018-09-30 Martin Jansa <Martin.Jansa@gmail.com>
+ Partial fix for [BZ #23716]
+ * locale/weight.h: Fix build with -Os.
+@@ -10917,7 +10925,7 @@
+ (CFLAGS-wcstof_l.c): Likewise.
+ (CPPFLAGS-tst-wchar-h.c): Likewise.
+ (CPPFLAGS-wcstold_l.c): Likewise.
+----
++
+ 2017-12-11 Paul A. Clarke <pc@us.ibm.com>
+
+ * sysdeps/ieee754/flt-32/s_cosf.c: New implementation.
+Index: git/posix/regexec.c
+===================================================================
+--- git.orig/posix/regexec.c
++++ git/posix/regexec.c
+@@ -1289,8 +1289,10 @@ proceed_next_node (const re_match_contex
+ else if (naccepted)
+ {
+ char *buf = (char *) re_string_get_buffer (&mctx->input);
+- if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
+- naccepted) != 0)
++ if (mctx->input.valid_len - *pidx < naccepted
++ || (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
++ naccepted)
++ != 0))
+ return -1;
+ }
+ }
diff --git a/meta/recipes-core/glibc/glibc_2.28.bb b/meta/recipes-core/glibc/glibc_2.28.bb
index 72cee04d9a..1bcec3ecb1 100644
--- a/meta/recipes-core/glibc/glibc_2.28.bb
+++ b/meta/recipes-core/glibc/glibc_2.28.bb
@@ -47,6 +47,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0032-sysdeps-ieee754-soft-fp-ignore-maybe-uninitialized-w.patch \
file://0033-locale-prevent-maybe-uninitialized-errors-with-Os-BZ.patch \
file://0034-inject-file-assembly-directives.patch \
+ file://CVE-2019-9169.patch \
"
NATIVESDKFIXES ?= ""