diff options
author | Rajkumar Veer <rveer@mvista.com> | 2017-11-04 10:45:58 -0700 |
---|---|---|
committer | Armin Kuster <akuster808@gmail.com> | 2018-02-22 11:11:24 -0800 |
commit | 7a7449a196656fd4c03b11cce1632abe0b461cb9 (patch) | |
tree | 4bda810530ca1a5a94bb86bbc19a1dc524b39e67 /meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch | |
parent | d10e1484033874309423fdd16e01a7cce66cec57 (diff) | |
download | openembedded-core-contrib-7a7449a196656fd4c03b11cce1632abe0b461cb9.tar.gz |
ruby: Security fix for CVE-2017-14064
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1
Signed-off-by: Rajkumar Veer <rveer@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
(cherry picked from commit 8d53b03e8fa1bc20c0d77d6cd7869bd7f7325987)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch')
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch | 79 |
1 files changed, 79 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch b/meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch new file mode 100644 index 0000000000..073d214d88 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2017-14064.patch @@ -0,0 +1,79 @@ +From 8f782fd8e181d9cfe9387ded43a5ca9692266b85 Mon Sep 17 00:00:00 2001 +From: Florian Frank <flori@ping.de> +Date: Thu, 2 Mar 2017 12:12:33 +0100 +Subject: [PATCH] Fix arbitrary heap exposure problem + +Upstream-Status: Backport +CVE: CVE-2017-14064 + +Signed-off-by: Rajkumar Veer<rveer@mvista.com> +--- + ext/json/ext/generator/generator.c | 12 ++++++------ + ext/json/ext/generator/generator.h | 1 - + 2 files changed, 6 insertions(+), 7 deletions(-) +--- a/ext/json/generator/generator.c ++++ b/ext/json/generator/generator.c +@@ -301,7 +301,7 @@ + char *result; + if (len <= 0) return NULL; + result = ALLOC_N(char, len); +- memccpy(result, ptr, 0, len); ++ memcpy(result, ptr, len); + return result; + } + +@@ -1055,7 +1055,7 @@ + } + } else { + if (state->indent) ruby_xfree(state->indent); +- state->indent = strdup(RSTRING_PTR(indent)); ++ state->indent = fstrndup(RSTRING_PTR(indent), len); + state->indent_len = len; + } + return Qnil; +@@ -1093,7 +1093,7 @@ + } + } else { + if (state->space) ruby_xfree(state->space); +- state->space = strdup(RSTRING_PTR(space)); ++ state->space = fstrndup(RSTRING_PTR(space), len); + state->space_len = len; + } + return Qnil; +@@ -1129,7 +1129,7 @@ + } + } else { + if (state->space_before) ruby_xfree(state->space_before); +- state->space_before = strdup(RSTRING_PTR(space_before)); ++ state->space_before = fstrndup(RSTRING_PTR(space_before), len); + state->space_before_len = len; + } + return Qnil; +@@ -1166,7 +1166,7 @@ + } + } else { + if (state->object_nl) ruby_xfree(state->object_nl); +- state->object_nl = strdup(RSTRING_PTR(object_nl)); ++ state->object_nl = fstrndup(RSTRING_PTR(object_nl), len); + state->object_nl_len = len; + } + return Qnil; +@@ -1201,7 +1201,7 @@ + } + } else { + if (state->array_nl) ruby_xfree(state->array_nl); +- state->array_nl = strdup(RSTRING_PTR(array_nl)); ++ state->array_nl = fstrndup(RSTRING_PTR(array_nl), len); + state->array_nl_len = len; + } + return Qnil; +--- a/ext/json/generator/generator.h ++++ b/ext/json/generator/generator.h +@@ -1,7 +1,6 @@ + #ifndef _GENERATOR_H_ + #define _GENERATOR_H_ + +-#include <string.h> + #include <math.h> + #include <ctype.h> + |