summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel BORNAZ <daniel.bornaz@enea.com>2014-07-24 15:51:44 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2014-07-25 15:34:01 +0100
commitda75a9aaf0064de4be0736983db08111701ccdae (patch)
tree3cbd67d65effa7bdc2f7f4cd7accdf62449a77ae
parent33a1a17f50bc9211691fd822c43226121e026cbe (diff)
downloadpoky-da75a9aaf0064de4be0736983db08111701ccdae.tar.gz
python: fix _json module arbitrary process memory read vulnerability
http://bugs.python.org/issue21529 Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index. The bug is caused by allowing the user to supply a negative index value. The index value is then used directly as an index to an array in the C code; internally the address of the array and its index are added to each other in order to yield the address of the value that is desired. However, by supplying a negative index value and adding this to the address of the array, the processor's register value wraps around and the calculated value will point to a position in memory which isn't within the bounds of the supplied string, causing the function to access other parts of the process memory. (From OE-Core rev: 9ec213bf67afbdfdbe25802ec86487bb22aeb2e4) Signed-off-by: Benjamin Peterson <benjamin@python.org> Applied to python-native recipe in order to fix the above mentioned vulnerability. Upstream-Status: Submitted Signed-off-by: Daniel BORNAZ <daniel.bornaz@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/python/python-native_2.7.3.bb1
-rw-r--r--meta/recipes-devtools/python/python/json-flaw-fix.patch27
-rw-r--r--meta/recipes-devtools/python/python_2.7.3.bb1
3 files changed, 29 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python-native_2.7.3.bb b/meta/recipes-devtools/python/python-native_2.7.3.bb
index 0571d3a488..827654dfa2 100644
--- a/meta/recipes-devtools/python/python-native_2.7.3.bb
+++ b/meta/recipes-devtools/python/python-native_2.7.3.bb
@@ -19,6 +19,7 @@ SRC_URI += "\
19 file://parallel-makeinst-create-bindir.patch \ 19 file://parallel-makeinst-create-bindir.patch \
20 file://python-fix-build-error-with-Readline-6.3.patch \ 20 file://python-fix-build-error-with-Readline-6.3.patch \
21 file://gcc-4.8-fix-configure-Wformat.patch \ 21 file://gcc-4.8-fix-configure-Wformat.patch \
22 file://json-flaw-fix.patch \
22 " 23 "
23S = "${WORKDIR}/Python-${PV}" 24S = "${WORKDIR}/Python-${PV}"
24 25
diff --git a/meta/recipes-devtools/python/python/json-flaw-fix.patch b/meta/recipes-devtools/python/python/json-flaw-fix.patch
new file mode 100644
index 0000000000..e9a6cca017
--- /dev/null
+++ b/meta/recipes-devtools/python/python/json-flaw-fix.patch
@@ -0,0 +1,27 @@
1
2python: fix _json module arbitrary process memory read vulnerability
3
4Upstream-Status: submitted
5
6Signed-off-by: Daniel BORNAZ <daniel.bornaz@enea.com>
7
8--- a/Modules/_json.c 2014-07-15 15:37:17.151046356 +0200
9+++ b/Modules/_json.c 2014-07-15 15:38:37.335605042 +0200
10@@ -1491,7 +1491,7 @@ scan_once_str(PyScannerObject *s, PyObje
11 PyObject *res;
12 char *str = PyString_AS_STRING(pystr);
13 Py_ssize_t length = PyString_GET_SIZE(pystr);
14- if (idx >= length) {
15+ if ( idx < 0 || idx >= length) {
16 PyErr_SetNone(PyExc_StopIteration);
17 return NULL;
18 }
19@@ -1578,7 +1578,7 @@ scan_once_unicode(PyScannerObject *s, Py
20 PyObject *res;
21 Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr);
22 Py_ssize_t length = PyUnicode_GET_SIZE(pystr);
23- if (idx >= length) {
24+ if ( idx < 0 || idx >= length) {
25 PyErr_SetNone(PyExc_StopIteration);
26 return NULL;
27 }
diff --git a/meta/recipes-devtools/python/python_2.7.3.bb b/meta/recipes-devtools/python/python_2.7.3.bb
index 0d641720f1..5be9073829 100644
--- a/meta/recipes-devtools/python/python_2.7.3.bb
+++ b/meta/recipes-devtools/python/python_2.7.3.bb
@@ -36,6 +36,7 @@ SRC_URI += "\
36 file://python-2.7.3-CVE-2013-1752-smtplib-fix.patch \ 36 file://python-2.7.3-CVE-2013-1752-smtplib-fix.patch \
37 file://python-fix-build-error-with-Readline-6.3.patch \ 37 file://python-fix-build-error-with-Readline-6.3.patch \
38 file://python-2.7.3-CVE-2014-1912.patch \ 38 file://python-2.7.3-CVE-2014-1912.patch \
39 file://json-flaw-fix.patch \
39" 40"
40 41
41S = "${WORKDIR}/Python-${PV}" 42S = "${WORKDIR}/Python-${PV}"