file: upgrade 5.37 -> 5.38

CVE-2019-18218.patch
Removed since it is included in 5.38.

(From OE-Core rev: 2ac297f8906354bf3a1578b5e78df040b4712b81)

Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 0 insertions, 55 deletions

diff --git a/meta/recipes-devtools/file/file/CVE-2019-18218.patch b/meta/recipes-devtools/file/file/CVE-2019-18218.patch
deleted file mode 100644
index 3d02c5ad4b..0000000000
--- a/meta/recipes-devtools/file/file/CVE-2019-18218.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-cdf_read_property_info in cdf.c in file through 5.37 does not restrict the
-number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte
-out-of-bounds write).
-
-CVE: CVE-2019-18218
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-From 46a8443f76cec4b41ec736eca396984c74664f84 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Mon, 26 Aug 2019 14:31:39 +0000
-Subject: [PATCH] Limit the number of elements in a vector (found by oss-fuzz)
-
----
- src/cdf.c | 9 ++++-----
- src/cdf.h | 1 +
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/cdf.c b/src/cdf.c
-index 9d6396742..bb81d6374 100644
---- a/src/cdf.c
-+++ b/src/cdf.c
-@@ -1016,8 +1016,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
-                                goto out;
-                        }
-                        nelements = CDF_GETUINT32(q, 1);
--                       if (nelements == 0) {
--                               DPRINTF(("CDF_VECTOR with nelements == 0\n"));
-+                       if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
-+                               DPRINTF(("CDF_VECTOR with nelements == %"
-+                                   SIZE_T_FORMAT "u\n", nelements));
-                                goto out;
-                        }
-                        slen = 2;
-@@ -1060,8 +1061,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
-                                        goto out;
-                                inp += nelem;
-                        }
--                       DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
--                           nelements));
-                        for (j = 0; j < nelements && i < sh.sh_properties;
-                            j++, i++)
-                        {
-diff --git a/src/cdf.h b/src/cdf.h
-index 2f7e554b7..05056668f 100644
---- a/src/cdf.h
-+++ b/src/cdf.h
-@@ -48,6 +48,7 @@
- typedef int32_t cdf_secid_t;
- 
- #define CDF_LOOP_LIMIT                                 10000
-+#define CDF_ELEMENT_LIMIT                              100000
- 
- #define CDF_SECID_NULL                                 0
- #define CDF_SECID_FREE                                 -1