diff options
| author |   Sona Sarmadi <sona.sarmadi@enea.com> | 2015-09-14 12:04:32 +0200 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-09-18 19:21:47 +0100 |
| commit | 553bc30b96cd9ef9c5bc621debcf7c23c66d7e42 (patch) | |
| tree | 3ebb2076aec3ab87277569fb336ad3d18ec05db6 /meta/recipes-support | |
| parent | 35ecb0b8557aae85f377c9d99f1a72cbb76fb6d8 (diff) | |
| download | openembedded-core-553bc30b96cd9ef9c5bc621debcf7c23c66d7e42.tar.gz | |
libtasn1: CVE-2015-3622
_asn1_extract_der_octet: prevent past of boundary access
References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3622
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;
h=f979435823a02f842c41d49cd41cc81f25b5d677
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Diffstat (limited to 'meta/recipes-support')
| -rw-r--r-- | meta/recipes-support/gnutls/libtasn1/libtasn1-CVE-2015-3622.patch | 44 | ||||
| -rw-r--r-- | meta/recipes-support/gnutls/libtasn1_4.0.bb | 1 |
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-support/gnutls/libtasn1/libtasn1-CVE-2015-3622.patch b/meta/recipes-support/gnutls/libtasn1/libtasn1-CVE-2015-3622.patch new file mode 100644 index 0000000000..0989ef6a21 --- /dev/null +++ b/meta/recipes-support/gnutls/libtasn1/libtasn1-CVE-2015-3622.patch @@ -0,0 +1,44 @@ +From f979435823a02f842c41d49cd41cc81f25b5d677 Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos <nmav@redhat.com> +Date: Mon, 20 Apr 2015 14:56:27 +0200 +Subject: [PATCH] _asn1_extract_der_octet: prevent past of boundary access + +Fixes CVE-2015-3622. +Upstream-Status: Backport + +Reported by Hanno Böck. +--- + lib/decoding.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/lib/decoding.c b/lib/decoding.c +index 7fbd931..42ddc6b 100644 +--- a/lib/decoding.c ++++ b/lib/decoding.c +@@ -732,6 +732,7 @@ _asn1_extract_der_octet (asn1_node node, const unsigned char *der, + return ASN1_DER_ERROR; + + counter = len3 + 1; ++ DECR_LEN(der_len, len3); + + if (len2 == -1) + counter_end = der_len - 2; +@@ -740,6 +741,7 @@ _asn1_extract_der_octet (asn1_node node, const unsigned char *der, + + while (counter < counter_end) + { ++ DECR_LEN(der_len, 1); + len2 = asn1_get_length_der (der + counter, der_len, &len3); + + if (IS_ERR(len2, flags)) +@@ -764,7 +766,6 @@ _asn1_extract_der_octet (asn1_node node, const unsigned char *der, + len2 = 0; + } + +- DECR_LEN(der_len, 1); + counter += len2 + len3 + 1; + } + +-- +1.7.2.5 + diff --git a/meta/recipes-support/gnutls/libtasn1_4.0.bb b/meta/recipes-support/gnutls/libtasn1_4.0.bb index 289833ec80..16cf4d6812 100644 --- a/meta/recipes-support/gnutls/libtasn1_4.0.bb +++ b/meta/recipes-support/gnutls/libtasn1_4.0.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \ SRC_URI = "${GNU_MIRROR}/libtasn1/libtasn1-${PV}.tar.gz \ file://libtasn1_fix_for_automake_1.12.patch \ file://dont-depend-on-help2man.patch \ + file://libtasn1-CVE-2015-3622.patch \ " SRC_URI[md5sum] = "d3d2d9bce3b6668b9827a9df52635be1" |