From 0fb90bef8c72bd39574d06c943c7a7220483870b Mon Sep 17 00:00:00 2001 From: Roy Li Date: Mon, 1 Jun 2015 16:04:16 +0800 Subject: mariadb: Security Advisory -CVE-2015-2305 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305 Signed-off-by: Roy Li Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster Conflicts: meta-oe/recipes-support/mysql/mariadb_5.5.39.inc --- .../mysql/mariadb/fix-CVE-2015-2305.patch | 43 ++++++++++++++++++++++ meta-oe/recipes-support/mysql/mariadb_5.5.39.inc | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch diff --git a/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch new file mode 100644 index 0000000000..2d1b467343 --- /dev/null +++ b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch @@ -0,0 +1,43 @@ +From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001 +From: Roy Li +Date: Mon, 1 Jun 2015 15:31:48 +0800 +Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17 + 00:00:00 2001 From: Gary Houston Date: Wed, 25 Feb + 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp + for excessively long pattern strings. CERT Vulnerability Note VU#695940. + Found by Guido Vranken. + +Upsteam-Status: Backport + +https://bugzilla.suse.com/attachment.cgi?id=627001 + +Signed-off-by: Roy Li +--- + regex/regcomp.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/regex/regcomp.c b/regex/regcomp.c +index abc1817..31e57c1 100644 +--- a/regex/regcomp.c ++++ b/regex/regcomp.c +@@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= { + (NC-1)*sizeof(cat_t)); + if (g == NULL) + return(REG_ESPACE); +- p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */ ++ { ++ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ ++ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ ++ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { ++ free((char *) g); ++ return REG_INVARG; ++ } ++ p->ssize = new_ssize; ++ } ++ + p->strip = (sop *)malloc(p->ssize * sizeof(sop)); + p->slen = 0; + if (p->strip == NULL) { +-- +1.9.1 + diff --git a/meta-oe/recipes-support/mysql/mariadb_5.5.39.inc b/meta-oe/recipes-support/mysql/mariadb_5.5.39.inc index ae2e92b5d1..bf15163da4 100644 --- a/meta-oe/recipes-support/mysql/mariadb_5.5.39.inc +++ b/meta-oe/recipes-support/mysql/mariadb_5.5.39.inc @@ -10,6 +10,7 @@ SRC_URI = "http://mirror.stshosting.co.uk/mariadb/mariadb-${PV}/source/mariadb-$ file://fix-mysqlclient-r-version.patch \ file://my.cnf \ file://mysqld.service \ + file://fix-CVE-2015-2305.patch \ " SRC_URI[md5sum] = "917a807d8cf2c8ef9deedd2a89b6decd" -- cgit 1.2.3-korg