diff options
Diffstat (limited to 'meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch')
-rw-r--r-- | meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch | 43 |
1 files changed, 0 insertions, 43 deletions
diff --git a/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch deleted file mode 100644 index 2d1b467343..0000000000 --- a/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch +++ /dev/null @@ -1,43 +0,0 @@ -From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001 -From: Roy Li <rongqing.li@windriver.com> -Date: Mon, 1 Jun 2015 15:31:48 +0800 -Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17 - 00:00:00 2001 From: Gary Houston <ghouston@arglist.com> Date: Wed, 25 Feb - 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp - for excessively long pattern strings. CERT Vulnerability Note VU#695940. - Found by Guido Vranken. - -Upsteam-Status: Backport - -https://bugzilla.suse.com/attachment.cgi?id=627001 - -Signed-off-by: Roy Li <rongqing.li@windriver.com> ---- - regex/regcomp.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/regex/regcomp.c b/regex/regcomp.c -index abc1817..31e57c1 100644 ---- a/regex/regcomp.c -+++ b/regex/regcomp.c -@@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= { - (NC-1)*sizeof(cat_t)); - if (g == NULL) - return(REG_ESPACE); -- p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */ -+ { -+ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ -+ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ -+ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { -+ free((char *) g); -+ return REG_INVARG; -+ } -+ p->ssize = new_ssize; -+ } -+ - p->strip = (sop *)malloc(p->ssize * sizeof(sop)); - p->slen = 0; - if (p->strip == NULL) { --- -1.9.1 - |