diff options
author | Yuanjie Huang <yuanjie.huang@windriver.com> | 2017-02-15 01:38:00 -0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-03-14 07:55:53 -0700 |
commit | 964bd533a9d4371c131559a74a503c7b60cbc3be (patch) | |
tree | ccfdfbebca52c0d175f7215328eaf39d6bf15112 /meta/recipes-devtools/gcc/gcc-6.3.inc | |
parent | 1118ff07f4ee96d481e4a062a2cbf2c9d60f451d (diff) | |
download | poky-964bd533a9d4371c131559a74a503c7b60cbc3be.tar.gz |
gcc: Fix CVE-2016-6131 in libiberty
[NVD] -- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6131
The demangler in GNU Libiberty allows remote attackers to cause a denial
of service (infinite loop, stack overflow, and crash) via a cycle in the
references of remembered mangled types.
[BZ #71696] -- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71696
2016-08-04 Marcel Böhme <boehme.marcel@gmail.com>
PR c++/71696
* cplus-dem.c: Prevent infinite recursion when there is a cycle
in the referencing of remembered mangled types.
(work_stuff): New stack to keep track of the remembered mangled
types that are currently being processed.
(push_processed_type): New method to push currently processed
remembered type onto the stack.
(pop_processed_type): New method to pop currently processed
remembered type from the stack.
(work_stuff_copy_to_from): Copy values of new variables.
(delete_non_B_K_work_stuff): Free stack memory.
(demangle_args): Push/Pop currently processed remembered type.
(do_type): Do not demangle a cyclic reference and push/pop
referenced remembered type.
cherry-picked from commit of
git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@239143 138bc75d-0d04-0410-961f-82ee72b054a4
(From OE-Core rev: 3c288b181a4cfecc80b48994f4dd2df285e4d1d0)
(From OE-Core rev: be00ad34a3827a4205718609f349bc6e8a09733b)
Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 96a16c4181d18b8580dad243350d589586cb2b07)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/gcc/gcc-6.3.inc')
-rw-r--r-- | meta/recipes-devtools/gcc/gcc-6.3.inc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/meta/recipes-devtools/gcc/gcc-6.3.inc b/meta/recipes-devtools/gcc/gcc-6.3.inc index 4f04c012c1..71d0affb89 100644 --- a/meta/recipes-devtools/gcc/gcc-6.3.inc +++ b/meta/recipes-devtools/gcc/gcc-6.3.inc | |||
@@ -83,6 +83,7 @@ SRC_URI = "\ | |||
83 | ${BACKPORTS} \ | 83 | ${BACKPORTS} \ |
84 | " | 84 | " |
85 | BACKPORTS = "\ | 85 | BACKPORTS = "\ |
86 | file://CVE-2016-6131.patch \ | ||
86 | file://ubsan-fix-check-empty-string.patch \ | 87 | file://ubsan-fix-check-empty-string.patch \ |
87 | " | 88 | " |
88 | SRC_URI[md5sum] = "677a7623c7ef6ab99881bc4e048debb6" | 89 | SRC_URI[md5sum] = "677a7623c7ef6ab99881bc4e048debb6" |