diff options
author | Thiruvadi Rajaraman <trajaraman@mvista.com> | 2017-09-21 19:28:06 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-01-07 17:09:47 +0000 |
commit | 7d46daa5e580e841f83b9070b3c84e87d8fd1181 (patch) | |
tree | 02a70bc3602b124fae7f7184b219a3a820962e85 /meta/recipes-devtools/binutils | |
parent | ea89dfe868085b463dfc24df78b49d1703989484 (diff) | |
download | openembedded-core-contrib-7d46daa5e580e841f83b9070b3c84e87d8fd1181.tar.gz |
binutils: CVE-2017-9753_and_CVE-2017-9754
Source: binutils-gdb.git
MR: 73958, 73945
Type: Security Fix
Disposition: Backport from binutils-2_29
ChangeID: a39fdc82900af3f5d6ae396c913ac902f4ef7f60
Description:
Fix seg-faults in objdump when disassembling a corrupt versados binary.
PR binutils/21591
* versados.c (versados_mkobject): Zero the allocated tdata structure.
(process_otr): Check for an invalid offset in the otr structure.
Affects: <= 2.28
Author: Nick Clifton <nickc@redhat.com>
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta/recipes-devtools/binutils')
-rw-r--r-- | meta/recipes-devtools/binutils/binutils-2.27.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch | 76 |
2 files changed, 77 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc index 54fb5d61c3..2b35cb154d 100644 --- a/meta/recipes-devtools/binutils/binutils-2.27.inc +++ b/meta/recipes-devtools/binutils/binutils-2.27.inc @@ -85,6 +85,7 @@ SRC_URI = "\ file://CVE-2017-9747.patch \ file://CVE-2017-9750.patch \ file://CVE-2017-9752.patch \ + file://CVE-2017-9753_9754.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch new file mode 100644 index 0000000000..fe1f9a100d --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch @@ -0,0 +1,76 @@ +commit 04f963fd489cae724a60140e13984415c205f4ac +Author: Nick Clifton <nickc@redhat.com> +Date: Wed Jun 14 10:35:16 2017 +0100 + + Fix seg-faults in objdump when disassembling a corrupt versados binary. + + PR binutils/21591 + * versados.c (versados_mkobject): Zero the allocated tdata structure. + (process_otr): Check for an invalid offset in the otr structure. + +Upstream-Status: Backport + +CVE: CVE-2017-9753 and CVE-2017-9754 +Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com> + +Index: git/bfd/versados.c +=================================================================== +--- git.orig/bfd/versados.c 2017-09-21 15:08:34.445197987 +0530 ++++ git/bfd/versados.c 2017-09-21 15:08:34.429197878 +0530 +@@ -149,7 +149,7 @@ + if (abfd->tdata.versados_data == NULL) + { + bfd_size_type amt = sizeof (tdata_type); +- tdata_type *tdata = bfd_alloc (abfd, amt); ++ tdata_type *tdata = bfd_zalloc (abfd, amt); + + if (tdata == NULL) + return FALSE; +@@ -344,13 +344,13 @@ + }; + + static int +-get_offset (int len, unsigned char *ptr) ++get_offset (unsigned int len, unsigned char *ptr) + { + int val = 0; + + if (len) + { +- int i; ++ unsigned int i; + + val = *ptr++; + if (val & 0x80) +@@ -393,9 +393,13 @@ + int flag = *srcp++; + int esdids = (flag >> 5) & 0x7; + int sizeinwords = ((flag >> 3) & 1) ? 2 : 1; +- int offsetlen = flag & 0x7; ++ unsigned int offsetlen = flag & 0x7; + int j; + ++ /* PR 21591: Check for invalid lengths. */ ++ if (srcp + esdids + offsetlen >= endp) ++ return; ++ + if (esdids == 0) + { + /* A zero esdid means the new pc is the offset given. */ +Index: git/bfd/ChangeLog +=================================================================== +--- git.orig/bfd/ChangeLog 2017-09-21 15:08:34.445197987 +0530 ++++ git/bfd/ChangeLog 2017-09-21 15:08:34.429197878 +0530 +@@ -90,6 +90,12 @@ + (_bfd_vms_slurp_etir): Add checks for attempts to read beyond the + end of etir record. + ++2017-06-14 Nick Clifton <nickc@redhat.com> ++ ++ PR binutils/21591 ++ * versados.c (versados_mkobject): Zero the allocated tdata structure. ++ (process_otr): Check for an invalid offset in the otr structure. ++ + 2017-04-29 Alan Modra <amodra@gmail.com> + + PR 21432 |