1 files changed, 33 insertions, 0 deletions
diff --git a/meta-oe/recipes-core/toybox/toybox/0001-Fix-segfault-in-login.patch b/meta-oe/recipes-core/toybox/toybox/0001-Fix-segfault-in-login.patch
new file mode 100644
index 0000000000..939885b961
--- /dev/null
+++ b/meta-oe/recipes-core/toybox/toybox/0001-Fix-segfault-in-login.patch
@@ -0,0 +1,33 @@
+From 863b129441c12eb75d63e4f4fe9a8f7df81607fd Mon Sep 17 00:00:00 2001
+From: Paul Barker <paul@paulbarker.me.uk>
+Date: Sun, 1 May 2016 14:50:59 +0100
+Subject: [PATCH] Fix segfault in login
+
+Fix a bug in readfileat where *plen would be corrupted if you didn't supply
+your own buffer (because ibuf is 0 in that case, not a pointer to the start
+of the allocated space). This caused a segfault in the 'login' program.
+
+Partial backport of upstream commit 81f31e463bd982a8344ea8681938eb43c9114652
+
+Signed-off-by: Paul Barker <paul@paulbarker.me.uk>
+Upstream-status: Backport
+---
+ lib/lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/lib.c b/lib/lib.c
+index 6559030..e5bb605 100644
+--- a/lib/lib.c
++++ b/lib/lib.c
+@@ -475,7 +475,7 @@ char *readfileat(int dirfd, char *name, char *ibuf, off_t *plen)
+     rbuf = buf+rlen;
+     len -= rlen;
+   }
+-  *plen = len = rlen+(buf-ibuf);
++  *plen = len = rlen+(rbuf-buf);
+   close(fd);
+ 
+   if (rlen<0) {
+-- 
+2.1.4
+