From 6205e64a9f6f5f1cb784774557c4b3608af62be3 Mon Sep 17 00:00:00 2001 From: Thiruvadi Rajaraman Date: Mon, 4 Sep 2017 16:39:25 +0530 Subject: binutils: CVE-2017-7302 Source: git://sourceware.org/git/binutils-gdb.git MR: 74218 Type: Security Fix Disposition: Backport from binutils-2_28-branch ChangeID: 11677f4fb24c7a49efc23ea7d54de1bf85e74b12 Description: Fix seg-fault running strip on a corrupt binary. PR binutils/20921 * aoutx.h (squirt_out_relocs): Check for and report any relocs that could not be recognised. Affects: <= 2.28 Author: Nick Clifton Signed-off-by: Thiruvadi Rajaraman Reviewed-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster --- meta/recipes-devtools/binutils/binutils-2.27.inc | 1 + .../binutils/binutils/CVE-2017-7302.patch | 81 ++++++++++++++++++++++ 2 files changed, 82 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc index 59e46b8bf4..936cdc3c98 100644 --- a/meta/recipes-devtools/binutils/binutils-2.27.inc +++ b/meta/recipes-devtools/binutils/binutils-2.27.inc @@ -64,6 +64,7 @@ SRC_URI = "\ file://CVE-2017-7225.patch \ file://CVE-2017-7227.patch \ file://CVE-2017-7301.patch \ + file://CVE-2017-7302.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch new file mode 100644 index 0000000000..a45de0e0ab --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch @@ -0,0 +1,81 @@ +commit e2996cc315d6ea242e1a954dc20246485ccc8512 +Author: Nick Clifton +Date: Mon Dec 5 14:32:30 2016 +0000 + + Fix seg-fault running strip on a corrupt binary. + + PR binutils/20921 + * aoutx.h (squirt_out_relocs): Check for and report any relocs + that could not be recognised. + +Upstream-Status: Backport + +CVE: CVE-2017-7302 +Signed-off-by: Thiruvadi Rajaraman + +Index: git/bfd/ChangeLog +=================================================================== +--- git.orig/bfd/ChangeLog 2017-09-04 15:57:38.564419146 +0530 ++++ git/bfd/ChangeLog 2017-09-04 16:02:31.994883900 +0530 +@@ -124,6 +124,10 @@ + (aout_link_add_symbols): Fix off by one error checking for + overflow of string offset. + ++ PR binutils/20921 ++ * aoutx.h (squirt_out_relocs): Check for and report any relocs ++ that could not be recognised. ++ + 2016-12-01 Nick Clifton + + PR binutils/20891 +Index: git/bfd/aoutx.h +=================================================================== +--- git.orig/bfd/aoutx.h 2017-09-04 15:57:38.564419146 +0530 ++++ git/bfd/aoutx.h 2017-09-04 16:01:08.830188291 +0530 +@@ -1952,6 +1952,7 @@ + + PUT_WORD (abfd, g->address, natptr->r_address); + ++ BFD_ASSERT (g->howto != NULL); + r_length = g->howto->size ; /* Size as a power of two. */ + r_pcrel = (int) g->howto->pc_relative; /* Relative to PC? */ + /* XXX This relies on relocs coming from a.out files. */ +@@ -2390,16 +2391,34 @@ + for (natptr = native; + count != 0; + --count, natptr += each_size, ++generic) +- MY_swap_ext_reloc_out (abfd, *generic, +- (struct reloc_ext_external *) natptr); ++ { ++ if ((*generic)->howto == NULL) ++ { ++ bfd_set_error (bfd_error_invalid_operation); ++ _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd); ++ return FALSE; ++ } ++ MY_swap_ext_reloc_out (abfd, *generic, ++ (struct reloc_ext_external *) natptr); ++ } + } + else + { + for (natptr = native; + count != 0; + --count, natptr += each_size, ++generic) +- MY_swap_std_reloc_out (abfd, *generic, +- (struct reloc_std_external *) natptr); ++ { ++ /* PR 20921: If the howto field has not been initialised then skip ++ this reloc. */ ++ if ((*generic)->howto == NULL) ++ { ++ bfd_set_error (bfd_error_invalid_operation); ++ _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd); ++ return FALSE; ++ } ++ MY_swap_std_reloc_out (abfd, *generic, ++ (struct reloc_std_external *) natptr); ++ } + } + + if (bfd_bwrite ((void *) native, natsize, abfd) != natsize) -- cgit 1.2.3-korg