summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorHongxu Jia <hongxu.jia@windriver.com>2018-08-21 14:30:27 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-08-23 07:50:00 +0100
commit8e66763b1ca45e8e3f2725d85530f7d688ad8955 (patch)
tree9c563b5e8871f6834a95ada73f29934cb17168a7 /meta
parentb45f3ecc00e04b22ce5d98f996e3ece00f58d8a1 (diff)
downloadpoky-8e66763b1ca45e8e3f2725d85530f7d688ad8955.tar.gz
nasm: fix CVE-2018-8883 & CVE-2018-8882 & CVE-2018-10316
(From OE-Core rev: 10a52e436d2f9a40c04271bc8aeb04c75fb11383) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch65
-rw-r--r--meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch50
-rw-r--r--meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch30
-rw-r--r--meta/recipes-devtools/nasm/nasm_2.13.03.bb3
4 files changed, 148 insertions, 0 deletions
diff --git a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
new file mode 100644
index 0000000000..a56a08b5a8
--- /dev/null
+++ b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch
@@ -0,0 +1,65 @@
1From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001
2From: Adam Majer <amajer@suse.de>
3Date: Fri, 17 Aug 2018 14:48:17 +0800
4Subject: [PATCH] Verify that we are not reading past end of a buffer
5
6Simple reproducer is just,
7
8 ret &d:ep
9
10which triggers a buffer overread due to parsing of an invalid
11segment override.
12
13Signed-off-by: Adam Majer <amajer@suse.de>
14
15Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392447]
16CVE: CVE-2018-8883
17Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
18---
19 include/opflags.h | 2 +-
20 include/tables.h | 1 +
21 x86/regs.pl | 3 ++-
22 3 files changed, 4 insertions(+), 2 deletions(-)
23
24diff --git a/include/opflags.h b/include/opflags.h
25index ef2838c1..8d4b6b1e 100644
26--- a/include/opflags.h
27+++ b/include/opflags.h
28@@ -166,7 +166,7 @@
29 #define REG_CLASS_BND GEN_REG_CLASS(9)
30
31 #define is_class(class, op) (!((opflags_t)(class) & ~(opflags_t)(op)))
32-#define is_reg_class(class, reg) is_class((class), nasm_reg_flags[(reg)])
33+#define is_reg_class(class, reg) is_class((class), ((reg) < nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0))
34
35 #define IS_SREG(reg) is_reg_class(REG_SREG, (reg))
36 #define IS_FSGS(reg) is_reg_class(REG_FSGS, (reg))
37diff --git a/include/tables.h b/include/tables.h
38index 24a665e2..458752ce 100644
39--- a/include/tables.h
40+++ b/include/tables.h
41@@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[];
42 typedef uint64_t opflags_t;
43 typedef uint16_t decoflags_t;
44 extern const opflags_t nasm_reg_flags[];
45+extern const size_t nasm_reg_flags_size;
46 /* regvals.c */
47 extern const int nasm_regvals[];
48
49diff --git a/x86/regs.pl b/x86/regs.pl
50index 3a1b56f5..cb5cea68 100755
51--- a/x86/regs.pl
52+++ b/x86/regs.pl
53@@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) {
54 printf " %-15s /* %-5s */\n",
55 $regs{$reg}.',', $reg;
56 }
57- print "};\n";
58+ print "};\n\n";
59+ print "const size_t nasm_reg_flags_size = sizeof(nasm_reg_flags) / sizeof(opflags_t);\n";
60 } elsif ( $fmt eq 'vc' ) {
61 # Output regvals.c
62 print "/* automatically generated from $file - do not edit */\n\n";
63--
642.17.1
65
diff --git a/meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch b/meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
new file mode 100644
index 0000000000..682d4c7277
--- /dev/null
+++ b/meta/recipes-devtools/nasm/nasm/0001-assemble-Check-global-line-limit.patch
@@ -0,0 +1,50 @@
1From 7a46d6b9e3a1d8a0ab0d816ef1bf194ad285e082 Mon Sep 17 00:00:00 2001
2From: "Chang S. Bae" <chang.seok.bae@intel.com>
3Date: Fri, 17 Aug 2018 14:26:03 +0800
4Subject: [PATCH] assemble: Check global line limit
5
6Without the limit, the while loop opens to semi-infinite
7that will exhaustively consume the heap space. Also, the
8index value gets into the garbage.
9
10https://bugzilla.nasm.us/show_bug.cgi?id=3392474
11
12Reported-by : Dongliang Mu <mudongliangabcd@gmail.com>
13Signed-off-by: Chang S. Bae <chang.seok.bae@intel.com>
14Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
15
16Upstream-Status: Backport from upstream [http://repo.or.cz/nasm.git]
17CVE: CVE-2018-10316
18Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
19---
20 asm/nasm.c | 7 ++++++-
21 1 file changed, 6 insertions(+), 1 deletion(-)
22
23diff --git a/asm/nasm.c b/asm/nasm.c
24index 8497ec9..81f6cee 100644
25--- a/asm/nasm.c
26+++ b/asm/nasm.c
27@@ -99,6 +99,8 @@ static char outname[FILENAME_MAX];
28 static char listname[FILENAME_MAX];
29 static char errname[FILENAME_MAX];
30 static int globallineno; /* for forward-reference tracking */
31+#define GLOBALLINENO_MAX INT32_MAX
32+
33 /* static int pass = 0; */
34 const struct ofmt *ofmt = &OF_DEFAULT;
35 const struct ofmt_alias *ofmt_alias = NULL;
36@@ -1360,7 +1362,10 @@ static void assemble_file(char *fname, StrList **depend_ptr)
37 location.offset = offs = get_curr_offs();
38
39 while ((line = preproc->getline())) {
40- globallineno++;
41+ if (globallineno++ == GLOBALLINENO_MAX)
42+ nasm_error(ERR_FATAL,
43+ "overall line number reaches the maximum %d\n",
44+ GLOBALLINENO_MAX);
45
46 /*
47 * Here we parse our directives; this is not handled by the
48--
492.7.4
50
diff --git a/meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch b/meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
new file mode 100644
index 0000000000..bc706c3f15
--- /dev/null
+++ b/meta/recipes-devtools/nasm/nasm/0001-fix-CVE-2018-8882.patch
@@ -0,0 +1,30 @@
1From 33438037e00ec750bff020578b1a5b6f75f60555 Mon Sep 17 00:00:00 2001
2From: Adam Majer <amajer@suse.de>
3Date: Fri, 17 Aug 2018 14:41:02 +0800
4Subject: [PATCH] fix CVE-2018-8882
5
6https://bugzilla.nasm.us/show_bug.cgi?id=3392445
7
8Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392445]
9CVE: CVE-2018-8882
10Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
11---
12 asm/float.c | 2 ++
13 1 file changed, 2 insertions(+)
14
15diff --git a/asm/float.c b/asm/float.c
16index dcf69fea..2965d3db 100644
17--- a/asm/float.c
18+++ b/asm/float.c
19@@ -608,6 +608,8 @@ static void ieee_shr(fp_limb *mant, int i)
20 if (offs)
21 for (j = MANT_LIMBS-1; j >= offs; j--)
22 mant[j] = mant[j-offs];
23+ } else if (MANT_LIMBS-1-offs < 0) {
24+ j = MANT_LIMBS-1;
25 } else {
26 n = mant[MANT_LIMBS-1-offs] >> sr;
27 for (j = MANT_LIMBS-1; j > offs; j--) {
28--
292.17.1
30
diff --git a/meta/recipes-devtools/nasm/nasm_2.13.03.bb b/meta/recipes-devtools/nasm/nasm_2.13.03.bb
index 236d7e5e36..6a02df4854 100644
--- a/meta/recipes-devtools/nasm/nasm_2.13.03.bb
+++ b/meta/recipes-devtools/nasm/nasm_2.13.03.bb
@@ -5,6 +5,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=90904486f8fbf1861cf42752e1a39efe"
5 5
6SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ 6SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \
7 file://0001-asmlib-Drop-pure-function-attribute-from-seg_init.patch \ 7 file://0001-asmlib-Drop-pure-function-attribute-from-seg_init.patch \
8 file://0001-assemble-Check-global-line-limit.patch \
9 file://0001-fix-CVE-2018-8882.patch \
10 file://0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch \
8 " 11 "
9 12
10SRC_URI[md5sum] = "0c581d482f39d5111879ca9601938f74" 13SRC_URI[md5sum] = "0c581d482f39d5111879ca9601938f74"