From 981eeec0f26f25db444782f40a86c558a2358215 Mon Sep 17 00:00:00 2001 From: Dan Tran Date: Mon, 9 Sep 2019 17:31:25 +0000 Subject: binutils: Fix 4 CVEs Fixes CVE-2018-20623, CVE-2018-20651, CVE-2018-20-671, and CVE-2018-1000876 for binutils 2.31.1. Signed-off-by: Dan Tran [fixed up .inc for thud-next context] Signed-off-by: Armin Kuster --- .../binutils/binutils/CVE-2018-20671.patch | 49 ++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch') diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch new file mode 100644 index 0000000000..9bd9207bb5 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-20671.patch @@ -0,0 +1,49 @@ +From 8a5f4f2ebe7f35ac5646060fa51e3332f6ef388c Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Fri, 4 Jan 2019 13:44:34 +0000 +Subject: [PATCH] Fix a possible integer overflow problem when examining + corrupt binaries using a 32-bit binutil. + + PR 24005 + * objdump.c (load_specific_debug_section): Check for integer + overflow before attempting to allocate contents. + +CVE: CVE-2018-20671 +Upstream-Status: Backport +[https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=11fa9f134fd658075c6f74499c780df045d9e9ca] + +Signed-off-by: Dan Tran +--- + binutils/objdump.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/binutils/objdump.c b/binutils/objdump.c +index f468fcdb59..89ca688938 100644 +--- a/binutils/objdump.c ++++ b/binutils/objdump.c +@@ -2503,12 +2503,19 @@ load_specific_debug_section (enum dwarf_section_display_enum debug, + section->reloc_info = NULL; + section->num_relocs = 0; + section->address = bfd_get_section_vma (abfd, sec); ++ section->user_data = sec; + section->size = bfd_get_section_size (sec); + amt = section->size + 1; ++ if (amt == 0 || amt > bfd_get_file_size (abfd)) ++ { ++ section->start = NULL; ++ free_debug_section (debug); ++ printf (_("\nSection '%s' has an invalid size: %#llx.\n"), ++ section->name, (unsigned long long) section->size); ++ return FALSE; ++ } + section->start = contents = malloc (amt); +- section->user_data = sec; +- if (amt == 0 +- || section->start == NULL ++ if (section->start == NULL + || !bfd_get_full_section_contents (abfd, sec, &contents)) + { + free_debug_section (debug); +-- +2.22.0.vfs.1.1.57.gbaf16c8 + -- cgit 1.2.3-korg