diff options
| author |   Armin Kuster <akuster@mvista.com> | 2018-08-05 21:53:37 -0700 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-08-06 16:23:55 +0100 |
| commit | 70308a1133a3bd0e9d297bd66be4e05722484e7a (patch) | |
| tree | 653cf1e6ed26a4c8c6b0c86e815a1b86df09b62a /meta/recipes-devtools | |
| parent | d128790b8593ee0cccd5e3c935ff28fb27644a8c (diff) | |
| download | openembedded-core-contrib-70308a1133a3bd0e9d297bd66be4e05722484e7a.tar.gz | |
binutls: Security fix CVE-2018-7643
Affects <= 2.30
Signed-off-by: Armin Kuster <akuster@mvista.com>
Diffstat (limited to 'meta/recipes-devtools')
| -rw-r--r-- | meta/recipes-devtools/binutils/binutils-2.30.inc | 1 | ||||
| -rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch | 102 |
2 files changed, 103 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.30.inc b/meta/recipes-devtools/binutils/binutils-2.30.inc index 349fa5a36a..1952d46c20 100644 --- a/meta/recipes-devtools/binutils/binutils-2.30.inc +++ b/meta/recipes-devtools/binutils/binutils-2.30.inc @@ -36,6 +36,7 @@ SRC_URI = "\ file://0014-Detect-64-bit-MIPS-targets.patch \ file://0015-sync-with-OE-libtool-changes.patch \ file://CVE-2018-8945.patch \ + file://CVE-2018-7643.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch new file mode 100644 index 0000000000..2a2dec3a48 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch @@ -0,0 +1,102 @@ +From d11ae95ea3403559f052903ab053f43ad7821e37 Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc@redhat.com> +Date: Thu, 1 Mar 2018 16:14:08 +0000 +Subject: [PATCH] Prevent illegal memory accesses triggerd by intger overflow + when parsing corrupt DWARF information on a 32-bit host. + + PR 22905 + * dwarf.c (display_debug_ranges): Check that the offset loaded + from the range_entry structure is valid. + +Upstream-Status: Backport +Affects: Binutils <= 2.30 +CVE: CVE-2018-7643 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + binutils/ChangeLog | 6 ++++++ + binutils/dwarf.c | 15 +++++++++++++++ + 2 files changed, 21 insertions(+) + +Index: git/binutils/dwarf.c +=================================================================== +--- git.orig/binutils/dwarf.c ++++ git/binutils/dwarf.c +@@ -387,6 +387,9 @@ read_uleb128 (unsigned char * data, + } \ + while (0) + ++/* Read AMOUNT bytes from PTR and store them in VAL as an unsigned value. ++ Checks to make sure that the read will not reach or pass END ++ and that VAL is big enough to hold AMOUNT bytes. */ + #define SAFE_BYTE_GET(VAL, PTR, AMOUNT, END) \ + do \ + { \ +@@ -415,6 +418,7 @@ read_uleb128 (unsigned char * data, + } \ + while (0) + ++/* Like SAFE_BYTE_GET, but also increments PTR by AMOUNT. */ + #define SAFE_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \ + do \ + { \ +@@ -423,6 +427,7 @@ read_uleb128 (unsigned char * data, + } \ + while (0) + ++/* Like SAFE_BYTE_GET, but reads a signed value. */ + #define SAFE_SIGNED_BYTE_GET(VAL, PTR, AMOUNT, END) \ + do \ + { \ +@@ -441,6 +446,7 @@ read_uleb128 (unsigned char * data, + } \ + while (0) + ++/* Like SAFE_SIGNED_BYTE_GET, but also increments PTR by AMOUNT. */ + #define SAFE_SIGNED_BYTE_GET_AND_INC(VAL, PTR, AMOUNT, END) \ + do \ + { \ +@@ -6543,6 +6549,7 @@ display_debug_ranges_list (unsigned char + break; + SAFE_SIGNED_BYTE_GET_AND_INC (end, start, pointer_size, finish); + ++ + printf (" %8.8lx ", offset); + + if (begin == 0 && end == 0) +@@ -6810,6 +6817,13 @@ display_debug_ranges (struct dwarf_secti + continue; + } + ++ if (next < section_begin || next >= finish) ++ { ++ warn (_("Corrupt offset (%#8.8lx) in range entry %u\n"), ++ (unsigned long) offset, i); ++ continue; ++ } ++ + if (dwarf_check != 0 && i > 0) + { + if (start < next) +@@ -6825,6 +6839,7 @@ display_debug_ranges (struct dwarf_secti + (unsigned long) (next - section_begin), section->name); + } + } ++ + start = next; + last_start = next; + +Index: git/bfd/ChangeLog +=================================================================== +--- git.orig/bfd/ChangeLog ++++ git/bfd/ChangeLog +@@ -1,3 +1,9 @@ ++2018-03-01 Nick Clifton <nickc@redhat.com> ++ ++ PR 22905 ++ * dwarf.c (display_debug_ranges): Check that the offset loaded ++ from the range_entry structure is valid. ++ + 2018-05-08 Nick Clifton <nickc@redhat.com> + + PR 22809 |