diff options
Diffstat (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch')
-rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch | 81 |
1 files changed, 81 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch new file mode 100644 index 0000000000..a45de0e0ab --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-7302.patch @@ -0,0 +1,81 @@ +commit e2996cc315d6ea242e1a954dc20246485ccc8512 +Author: Nick Clifton <nickc@redhat.com> +Date: Mon Dec 5 14:32:30 2016 +0000 + + Fix seg-fault running strip on a corrupt binary. + + PR binutils/20921 + * aoutx.h (squirt_out_relocs): Check for and report any relocs + that could not be recognised. + +Upstream-Status: Backport + +CVE: CVE-2017-7302 +Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com> + +Index: git/bfd/ChangeLog +=================================================================== +--- git.orig/bfd/ChangeLog 2017-09-04 15:57:38.564419146 +0530 ++++ git/bfd/ChangeLog 2017-09-04 16:02:31.994883900 +0530 +@@ -124,6 +124,10 @@ + (aout_link_add_symbols): Fix off by one error checking for + overflow of string offset. + ++ PR binutils/20921 ++ * aoutx.h (squirt_out_relocs): Check for and report any relocs ++ that could not be recognised. ++ + 2016-12-01 Nick Clifton <nickc@redhat.com> + + PR binutils/20891 +Index: git/bfd/aoutx.h +=================================================================== +--- git.orig/bfd/aoutx.h 2017-09-04 15:57:38.564419146 +0530 ++++ git/bfd/aoutx.h 2017-09-04 16:01:08.830188291 +0530 +@@ -1952,6 +1952,7 @@ + + PUT_WORD (abfd, g->address, natptr->r_address); + ++ BFD_ASSERT (g->howto != NULL); + r_length = g->howto->size ; /* Size as a power of two. */ + r_pcrel = (int) g->howto->pc_relative; /* Relative to PC? */ + /* XXX This relies on relocs coming from a.out files. */ +@@ -2390,16 +2391,34 @@ + for (natptr = native; + count != 0; + --count, natptr += each_size, ++generic) +- MY_swap_ext_reloc_out (abfd, *generic, +- (struct reloc_ext_external *) natptr); ++ { ++ if ((*generic)->howto == NULL) ++ { ++ bfd_set_error (bfd_error_invalid_operation); ++ _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd); ++ return FALSE; ++ } ++ MY_swap_ext_reloc_out (abfd, *generic, ++ (struct reloc_ext_external *) natptr); ++ } + } + else + { + for (natptr = native; + count != 0; + --count, natptr += each_size, ++generic) +- MY_swap_std_reloc_out (abfd, *generic, +- (struct reloc_std_external *) natptr); ++ { ++ /* PR 20921: If the howto field has not been initialised then skip ++ this reloc. */ ++ if ((*generic)->howto == NULL) ++ { ++ bfd_set_error (bfd_error_invalid_operation); ++ _bfd_error_handler (_("%B: attempt to write out unknown reloc type"), abfd); ++ return FALSE; ++ } ++ MY_swap_std_reloc_out (abfd, *generic, ++ (struct reloc_std_external *) natptr); ++ } + } + + if (bfd_bwrite ((void *) native, natsize, abfd) != natsize) |