summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/ruby
diff options
context:
space:
mode:
authorJoe Slater <jslater@windriver.com>2017-08-16 14:46:11 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2017-08-18 10:40:26 +0100
commit391127b00291bddba010813f9e033a31290c3b66 (patch)
treebfba3bfa4b786b3dfb830721d8c48febd14c180a /meta/recipes-devtools/ruby
parentf14f918d9db871cb91811a4f28e42b317634aab4 (diff)
downloadpoky-391127b00291bddba010813f9e033a31290c3b66.tar.gz
ruby: fix CVE-2017-9224
Use DATA_ENSURE(1) before access. (From OE-Core rev: 9db907a0bd331c47c4882b82f9f1d2a7ef1f6d1f) Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/ruby')
-rw-r--r--meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-9224.patch41
-rw-r--r--meta/recipes-devtools/ruby/ruby_2.4.1.bb4
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-9224.patch b/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-9224.patch
new file mode 100644
index 0000000000..848139b7e3
--- /dev/null
+++ b/meta/recipes-devtools/ruby/ruby/ruby-CVE-2017-9224.patch
@@ -0,0 +1,41 @@
1From 690313a061f7a4fa614ec5cc8368b4f2284e059b Mon Sep 17 00:00:00 2001
2From: "K.Kosako" <kosako@sofnec.co.jp>
3Date: Tue, 23 May 2017 10:28:58 +0900
4Subject: [PATCH] fix #57 : DATA_ENSURE() check must be before data access
5
6---
7 regexec.c | 5 -----
8 1 file changed, 5 deletions(-)
9
10--- end of original header
11
12CVE: CVE-2017-9224
13
14Context modified so that patch applies for version 2.4.1.
15
16Upstream-Status: Pending
17Signed-off-by: Joe Slater <joe.slater@windriver.com>
18
19
20diff --git a/regexec.c b/regexec.c
21index 35fef11..d4e577d 100644
22--- a/regexec.c
23+++ b/regexec.c
24@@ -1473,14 +1473,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
25 NEXT;
26
27 CASE(OP_EXACT1) MOP_IN(OP_EXACT1);
28-#if 0
29 DATA_ENSURE(1);
30 if (*p != *s) goto fail;
31 p++; s++;
32-#endif
33- if (*p != *s++) goto fail;
34- DATA_ENSURE(0);
35- p++;
36 MOP_OUT;
37 break;
38
39--
401.7.9.5
41
diff --git a/meta/recipes-devtools/ruby/ruby_2.4.1.bb b/meta/recipes-devtools/ruby/ruby_2.4.1.bb
index 1d335f1c28..77e17f199b 100644
--- a/meta/recipes-devtools/ruby/ruby_2.4.1.bb
+++ b/meta/recipes-devtools/ruby/ruby_2.4.1.bb
@@ -1,5 +1,9 @@
1require ruby.inc 1require ruby.inc
2 2
3SRC_URI += " \
4 file://ruby-CVE-2017-9224.patch \
5 "
6
3SRC_URI[md5sum] = "782bca562e474dd25956dd0017d92677" 7SRC_URI[md5sum] = "782bca562e474dd25956dd0017d92677"
4SRC_URI[sha256sum] = "a330e10d5cb5e53b3a0078326c5731888bb55e32c4abfeb27d9e7f8e5d000250" 8SRC_URI[sha256sum] = "a330e10d5cb5e53b3a0078326c5731888bb55e32c4abfeb27d9e7f8e5d000250"
5 9