From 626f518df57868250ea467532b8cf2968d78df6d Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Mon, 4 Nov 2019 12:14:55 +0000 Subject: file: fix CVE-2019-18218 Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- .../file/file/CVE-2019-18218.patch | 55 ++++++++++++++++++++++ meta/recipes-devtools/file/file_5.37.bb | 3 +- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/file/file/CVE-2019-18218.patch (limited to 'meta') diff --git a/meta/recipes-devtools/file/file/CVE-2019-18218.patch b/meta/recipes-devtools/file/file/CVE-2019-18218.patch new file mode 100644 index 0000000000..3d02c5ad4b --- /dev/null +++ b/meta/recipes-devtools/file/file/CVE-2019-18218.patch @@ -0,0 +1,55 @@ +cdf_read_property_info in cdf.c in file through 5.37 does not restrict the +number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte +out-of-bounds write). + +CVE: CVE-2019-18218 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +From 46a8443f76cec4b41ec736eca396984c74664f84 Mon Sep 17 00:00:00 2001 +From: Christos Zoulas +Date: Mon, 26 Aug 2019 14:31:39 +0000 +Subject: [PATCH] Limit the number of elements in a vector (found by oss-fuzz) + +--- + src/cdf.c | 9 ++++----- + src/cdf.h | 1 + + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/cdf.c b/src/cdf.c +index 9d6396742..bb81d6374 100644 +--- a/src/cdf.c ++++ b/src/cdf.c +@@ -1016,8 +1016,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + } + nelements = CDF_GETUINT32(q, 1); +- if (nelements == 0) { +- DPRINTF(("CDF_VECTOR with nelements == 0\n")); ++ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) { ++ DPRINTF(("CDF_VECTOR with nelements == %" ++ SIZE_T_FORMAT "u\n", nelements)); + goto out; + } + slen = 2; +@@ -1060,8 +1061,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + inp += nelem; + } +- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", +- nelements)); + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { +diff --git a/src/cdf.h b/src/cdf.h +index 2f7e554b7..05056668f 100644 +--- a/src/cdf.h ++++ b/src/cdf.h +@@ -48,6 +48,7 @@ + typedef int32_t cdf_secid_t; + + #define CDF_LOOP_LIMIT 10000 ++#define CDF_ELEMENT_LIMIT 100000 + + #define CDF_SECID_NULL 0 + #define CDF_SECID_FREE -1 diff --git a/meta/recipes-devtools/file/file_5.37.bb b/meta/recipes-devtools/file/file_5.37.bb index c53a120b84..71801f9d47 100644 --- a/meta/recipes-devtools/file/file_5.37.bb +++ b/meta/recipes-devtools/file/file_5.37.bb @@ -14,7 +14,8 @@ DEPENDS_class-native = "zlib-native" # Blacklist a bogus tag in upstream check UPSTREAM_CHECK_GITTAGREGEX = "FILE(?P(?!6_23).+)" -SRC_URI = "git://github.com/file/file.git" +SRC_URI = "git://github.com/file/file.git \ + file://CVE-2019-18218.patch" SRCREV = "a0d5b0e4e9f97d74a9911e95cedd579852e25398" S = "${WORKDIR}/git" -- cgit 1.2.3-korg