diff options
author | Dan Tran <dantran@microsoft.com> | 2019-09-09 17:31:25 +0000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2019-10-08 22:52:28 +0100 |
commit | 45cebeda6e501b9c31ab40030267ea1d6840f34b (patch) | |
tree | 6ae14795341bebe2889342ee1d7d23ba95977705 /meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch | |
parent | 36fa7fce0212e5b8eb9913996156cb5db5c104f3 (diff) | |
download | poky-45cebeda6e501b9c31ab40030267ea1d6840f34b.tar.gz |
binutils: Fix 4 CVEs
Fixes CVE-2018-20623, CVE-2018-20651, CVE-2018-20-671, and
CVE-2018-1000876 for binutils 2.31.1.
(From OE-Core rev: 981eeec0f26f25db444782f40a86c558a2358215)
Signed-off-by: Dan Tran <dantran@microsoft.com>
[fixed up .inc for thud-next context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch')
-rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch | 74 |
1 files changed, 74 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch b/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch new file mode 100644 index 0000000000..b44d448fce --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-20623.patch | |||
@@ -0,0 +1,74 @@ | |||
1 | From 90cce28d4b59f86366d4f562d01a8d439d514234 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nick Clifton <nickc@redhat.com> | ||
3 | Date: Wed, 9 Jan 2019 12:25:16 +0000 | ||
4 | Subject: [PATCH] Fix a heap use after free memory access fault when displaying | ||
5 | error messages about malformed archives. | ||
6 | |||
7 | PR 14049 | ||
8 | * readelf.c (process_archive): Use arch.file_name in error | ||
9 | messages until the qualified name is available. | ||
10 | |||
11 | CVE: CVE-2018-20623 | ||
12 | Upstream-Status: Backport | ||
13 | [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=28e817cc440bce73691c03e01860089a0954a837] | ||
14 | |||
15 | Signed-off-by: Dan Tran <dantran@microsoft.com> | ||
16 | --- | ||
17 | binutils/readelf.c | 13 ++++++++----- | ||
18 | 1 file changed, 8 insertions(+), 5 deletions(-) | ||
19 | |||
20 | diff --git a/binutils/readelf.c b/binutils/readelf.c | ||
21 | index f4df697a7d..280023d8de 100644 | ||
22 | --- a/binutils/readelf.c | ||
23 | +++ b/binutils/readelf.c | ||
24 | @@ -19061,7 +19061,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) | ||
25 | /* Read the next archive header. */ | ||
26 | if (fseek (filedata->handle, arch.next_arhdr_offset, SEEK_SET) != 0) | ||
27 | { | ||
28 | - error (_("%s: failed to seek to next archive header\n"), filedata->file_name); | ||
29 | + error (_("%s: failed to seek to next archive header\n"), arch.file_name); | ||
30 | return FALSE; | ||
31 | } | ||
32 | got = fread (&arch.arhdr, 1, sizeof arch.arhdr, filedata->handle); | ||
33 | @@ -19069,7 +19069,10 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) | ||
34 | { | ||
35 | if (got == 0) | ||
36 | break; | ||
37 | - error (_("%s: failed to read archive header\n"), filedata->file_name); | ||
38 | + /* PR 24049 - we cannot use filedata->file_name as this will | ||
39 | + have already been freed. */ | ||
40 | + error (_("%s: failed to read archive header\n"), arch.file_name); | ||
41 | + | ||
42 | ret = FALSE; | ||
43 | break; | ||
44 | } | ||
45 | @@ -19089,7 +19092,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) | ||
46 | name = get_archive_member_name (&arch, &nested_arch); | ||
47 | if (name == NULL) | ||
48 | { | ||
49 | - error (_("%s: bad archive file name\n"), filedata->file_name); | ||
50 | + error (_("%s: bad archive file name\n"), arch.file_name); | ||
51 | ret = FALSE; | ||
52 | break; | ||
53 | } | ||
54 | @@ -19098,7 +19101,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) | ||
55 | qualified_name = make_qualified_name (&arch, &nested_arch, name); | ||
56 | if (qualified_name == NULL) | ||
57 | { | ||
58 | - error (_("%s: bad archive file name\n"), filedata->file_name); | ||
59 | + error (_("%s: bad archive file name\n"), arch.file_name); | ||
60 | ret = FALSE; | ||
61 | break; | ||
62 | } | ||
63 | @@ -19144,7 +19147,7 @@ process_archive (Filedata * filedata, bfd_boolean is_thin_archive) | ||
64 | if (nested_arch.file == NULL) | ||
65 | { | ||
66 | error (_("%s: contains corrupt thin archive: %s\n"), | ||
67 | - filedata->file_name, name); | ||
68 | + qualified_name, name); | ||
69 | ret = FALSE; | ||
70 | break; | ||
71 | } | ||
72 | -- | ||
73 | 2.22.0.vfs.1.1.57.gbaf16c8 | ||
74 | |||