diff options
author | Armin Kuster <akuster808@gmail.com> | 2019-08-15 07:26:42 -0700 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-09-30 16:44:41 +0100 |
commit | 1eb6e018a3733ca6065141ce04b59bc02ad452ef (patch) | |
tree | 0057f62d8925276a890f3019df5d750e0db2c6f6 | |
parent | 271c0c2dc1e65f6b32bbc9d0521c627c82cd47b7 (diff) | |
download | poky-1eb6e018a3733ca6065141ce04b59bc02ad452ef.tar.gz |
qemu: fix CVE-2018-20815
(From OE-Core rev: 0b73e48c64cb8e651c81b19ddabdd108e4024697)
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2018-20815.patch | 38 |
2 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index ecf13dc78a..3de87d3d78 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -31,6 +31,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
31 | file://0019-fix-CVE-2018-20216.patch \ | 31 | file://0019-fix-CVE-2018-20216.patch \ |
32 | file://CVE-2019-3812.patch \ | 32 | file://CVE-2019-3812.patch \ |
33 | file://0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch \ | 33 | file://0014-linux-user-fix-to-handle-variably-sized-SIOCGSTAMP-w.patch \ |
34 | file://CVE-2018-20815.patch \ | ||
34 | " | 35 | " |
35 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 36 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
36 | 37 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-20815.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815.patch new file mode 100644 index 0000000000..c9508d9ba8 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-20815.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | From 8bb018af1a7f2b9965f872a4b1121864e73e1b61 Mon Sep 17 00:00:00 2001 | ||
2 | From: Peter Maydell <peter.maydell@linaro.org> | ||
3 | Date: Fri, 14 Dec 2018 13:30:52 +0000 | ||
4 | Subject: [PATCH] device_tree.c: Don't use load_image() | ||
5 | |||
6 | The load_image() function is deprecated, as it does not let the | ||
7 | caller specify how large the buffer to read the file into is. | ||
8 | Instead use load_image_size(). | ||
9 | |||
10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
11 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
12 | Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> | ||
13 | Reviewed-by: Michael S. Tsirkin <mst@redhat.com> | ||
14 | Reviewed-by: Eric Blake <eblake@redhat.com> | ||
15 | Message-id: 20181130151712.2312-9-peter.maydell@linaro.org | ||
16 | |||
17 | Upstream-Status: Backport [https://github.com/qemu/qemu/commit/da885fe1ee8b4589047484bd7fa05a4905b52b17] | ||
18 | CVE: CVE-2018-20815 | ||
19 | Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> | ||
20 | --- | ||
21 | device_tree.c | 2 +- | ||
22 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
23 | |||
24 | diff --git a/device_tree.c b/device_tree.c | ||
25 | index 6d9c9726f6..296278e12a 100644 | ||
26 | --- a/device_tree.c | ||
27 | +++ b/device_tree.c | ||
28 | @@ -91,7 +91,7 @@ void *load_device_tree(const char *filename_path, int *sizep) | ||
29 | /* First allocate space in qemu for device tree */ | ||
30 | fdt = g_malloc0(dt_size); | ||
31 | |||
32 | - dt_file_load_size = load_image(filename_path, fdt); | ||
33 | + dt_file_load_size = load_image_size(filename_path, fdt, dt_size); | ||
34 | if (dt_file_load_size < 0) { | ||
35 | error_report("Unable to open device tree file '%s'", | ||
36 | filename_path); | ||
37 | -- | ||
38 | 2.17.1 | ||