diff options
author | Roy Li <rongqing.li@windriver.com> | 2015-06-01 16:04:16 +0800 |
---|---|---|
committer | Martin Jansa <Martin.Jansa@gmail.com> | 2015-06-08 14:15:24 +0200 |
commit | 4bcddcaccb5950ec0208e2a25eb05c7016e25db4 (patch) | |
tree | e8b19c5fb4a14262dfa4648eca90e4fb41ab6004 /meta-oe/recipes-support/mysql | |
parent | a145099a9c575f07cf06fe981a6df85890f7b3ac (diff) | |
download | meta-openembedded-4bcddcaccb5950ec0208e2a25eb05c7016e25db4.tar.gz |
mariadb: Security Advisory -CVE-2015-2305
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Diffstat (limited to 'meta-oe/recipes-support/mysql')
-rw-r--r-- | meta-oe/recipes-support/mysql/mariadb.inc | 1 | ||||
-rw-r--r-- | meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch | 43 |
2 files changed, 44 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/mysql/mariadb.inc b/meta-oe/recipes-support/mysql/mariadb.inc index 5a1cde44f..e7e280522 100644 --- a/meta-oe/recipes-support/mysql/mariadb.inc +++ b/meta-oe/recipes-support/mysql/mariadb.inc | |||
@@ -12,6 +12,7 @@ SRC_URI = "http://mirror.stshosting.co.uk/mariadb/mariadb-${PV}/source/mariadb-$ | |||
12 | file://mysqld.service \ | 12 | file://mysqld.service \ |
13 | file://configure.cmake-fix-valgrind.patch \ | 13 | file://configure.cmake-fix-valgrind.patch \ |
14 | file://fix-a-building-failure.patch \ | 14 | file://fix-a-building-failure.patch \ |
15 | file://fix-CVE-2015-2305.patch \ | ||
15 | " | 16 | " |
16 | 17 | ||
17 | SRC_URI[md5sum] = "c8760d6b5890fc1de76c07af48092c88" | 18 | SRC_URI[md5sum] = "c8760d6b5890fc1de76c07af48092c88" |
diff --git a/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch new file mode 100644 index 000000000..2d1b46734 --- /dev/null +++ b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch | |||
@@ -0,0 +1,43 @@ | |||
1 | From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001 | ||
2 | From: Roy Li <rongqing.li@windriver.com> | ||
3 | Date: Mon, 1 Jun 2015 15:31:48 +0800 | ||
4 | Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17 | ||
5 | 00:00:00 2001 From: Gary Houston <ghouston@arglist.com> Date: Wed, 25 Feb | ||
6 | 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp | ||
7 | for excessively long pattern strings. CERT Vulnerability Note VU#695940. | ||
8 | Found by Guido Vranken. | ||
9 | |||
10 | Upsteam-Status: Backport | ||
11 | |||
12 | https://bugzilla.suse.com/attachment.cgi?id=627001 | ||
13 | |||
14 | Signed-off-by: Roy Li <rongqing.li@windriver.com> | ||
15 | --- | ||
16 | regex/regcomp.c | 11 ++++++++++- | ||
17 | 1 file changed, 10 insertions(+), 1 deletion(-) | ||
18 | |||
19 | diff --git a/regex/regcomp.c b/regex/regcomp.c | ||
20 | index abc1817..31e57c1 100644 | ||
21 | --- a/regex/regcomp.c | ||
22 | +++ b/regex/regcomp.c | ||
23 | @@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= { | ||
24 | (NC-1)*sizeof(cat_t)); | ||
25 | if (g == NULL) | ||
26 | return(REG_ESPACE); | ||
27 | - p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */ | ||
28 | + { | ||
29 | + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ | ||
30 | + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ | ||
31 | + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { | ||
32 | + free((char *) g); | ||
33 | + return REG_INVARG; | ||
34 | + } | ||
35 | + p->ssize = new_ssize; | ||
36 | + } | ||
37 | + | ||
38 | p->strip = (sop *)malloc(p->ssize * sizeof(sop)); | ||
39 | p->slen = 0; | ||
40 | if (p->strip == NULL) { | ||
41 | -- | ||
42 | 1.9.1 | ||
43 | |||