diff options
author | Archana Polampalli <archana.polampalli@windriver.com> | 2023-04-26 06:46:18 +0000 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-05-03 04:17:12 -1000 |
commit | bfe251d727b8d39676b2458134f90b3ae16613b5 (patch) | |
tree | 3e17c8d97d7df79452d0440ca1e02636dbbd0bb5 /meta | |
parent | 9971a61f08175918db43fab605d7725c3076a5ef (diff) | |
download | poky-bfe251d727b8d39676b2458134f90b3ae16613b5.tar.gz |
nasm: fix CVE-2022-44370
NASM v2.16 was discovered to contain a heap buffer overflow in the
component quote_for_pmake() asm/nasm.c:856
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-44370
Upstream patches:
https://github.com/netwide-assembler/nasm/commit/2d4e6952417ec6f08b6f135d2b5d0e19b7dae30d
(From OE-Core rev: 1568df72136f46f0767bba56c10c48bf2a1ec259)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch | 104 | ||||
-rw-r--r-- | meta/recipes-devtools/nasm/nasm_2.15.05.bb | 1 |
2 files changed, 105 insertions, 0 deletions
diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch b/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch new file mode 100644 index 0000000000..1bd49c9fd9 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2022-44370.patch | |||
@@ -0,0 +1,104 @@ | |||
1 | From b37677f7e40276bd8f504584bcba2c092f1146a8 Mon Sep 17 00:00:00 2001 | ||
2 | From: "H. Peter Anvin" <hpa@zytor.com> | ||
3 | Date: Mon, 7 Nov 2022 10:26:03 -0800 | ||
4 | Subject: [PATCH] quote_for_pmake: fix counter underrun resulting in segfault | ||
5 | |||
6 | while (nbs--) { ... } ends with nbs == -1. Rather than a minimal fix, | ||
7 | introduce mempset() to make these kinds of errors less likely in the | ||
8 | future. | ||
9 | |||
10 | Fixes: https://bugzilla.nasm.us/show_bug.cgi?id=3392815 | ||
11 | Reported-by: <13579and24680@gmail.com> | ||
12 | Signed-off-by: H. Peter Anvin <hpa@zytor.com> | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | CVE: CVE-2022-4437 | ||
16 | |||
17 | Reference to upstream patch: | ||
18 | [https://github.com/netwide-assembler/nasm/commit/2d4e6952417ec6f08b6f135d2b5d0e19b7dae30d] | ||
19 | |||
20 | Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> | ||
21 | --- | ||
22 | asm/nasm.c | 12 +++++------- | ||
23 | configure.ac | 1 + | ||
24 | include/compiler.h | 7 +++++++ | ||
25 | 3 files changed, 13 insertions(+), 7 deletions(-) | ||
26 | |||
27 | diff --git a/asm/nasm.c b/asm/nasm.c | ||
28 | index 7a7f8b4..675cff4 100644 | ||
29 | --- a/asm/nasm.c | ||
30 | +++ b/asm/nasm.c | ||
31 | @@ -1,6 +1,6 @@ | ||
32 | /* ----------------------------------------------------------------------- * | ||
33 | * | ||
34 | - * Copyright 1996-2020 The NASM Authors - All Rights Reserved | ||
35 | + * Copyright 1996-2022 The NASM Authors - All Rights Reserved | ||
36 | * See the file AUTHORS included with the NASM distribution for | ||
37 | * the specific copyright holders. | ||
38 | * | ||
39 | @@ -814,8 +814,7 @@ static char *quote_for_pmake(const char *str) | ||
40 | } | ||
41 | |||
42 | /* Convert N backslashes at the end of filename to 2N backslashes */ | ||
43 | - if (nbs) | ||
44 | - n += nbs; | ||
45 | + n += nbs; | ||
46 | |||
47 | os = q = nasm_malloc(n); | ||
48 | |||
49 | @@ -824,10 +823,10 @@ static char *quote_for_pmake(const char *str) | ||
50 | switch (*p) { | ||
51 | case ' ': | ||
52 | case '\t': | ||
53 | - while (nbs--) | ||
54 | - *q++ = '\\'; | ||
55 | + q = mempset(q, '\\', nbs); | ||
56 | *q++ = '\\'; | ||
57 | *q++ = *p; | ||
58 | + nbs = 0; | ||
59 | break; | ||
60 | case '$': | ||
61 | *q++ = *p; | ||
62 | @@ -849,9 +848,8 @@ static char *quote_for_pmake(const char *str) | ||
63 | break; | ||
64 | } | ||
65 | } | ||
66 | - while (nbs--) | ||
67 | - *q++ = '\\'; | ||
68 | |||
69 | + q = mempset(q, '\\', nbs); | ||
70 | *q = '\0'; | ||
71 | |||
72 | return os; | ||
73 | diff --git a/configure.ac b/configure.ac | ||
74 | index 39680b1..940ebe2 100644 | ||
75 | --- a/configure.ac | ||
76 | +++ b/configure.ac | ||
77 | @@ -199,6 +199,7 @@ AC_CHECK_FUNCS(strrchrnul) | ||
78 | AC_CHECK_FUNCS(iscntrl) | ||
79 | AC_CHECK_FUNCS(isascii) | ||
80 | AC_CHECK_FUNCS(mempcpy) | ||
81 | +AC_CHECK_FUNCS(mempset) | ||
82 | |||
83 | AC_CHECK_FUNCS(getuid) | ||
84 | AC_CHECK_FUNCS(getgid) | ||
85 | diff --git a/include/compiler.h b/include/compiler.h | ||
86 | index db3d6d6..b64da6a 100644 | ||
87 | --- a/include/compiler.h | ||
88 | +++ b/include/compiler.h | ||
89 | @@ -256,6 +256,13 @@ static inline void *mempcpy(void *dst, const void *src, size_t n) | ||
90 | } | ||
91 | #endif | ||
92 | |||
93 | +#ifndef HAVE_MEMPSET | ||
94 | +static inline void *mempset(void *dst, int c, size_t n) | ||
95 | +{ | ||
96 | + return (char *)memset(dst, c, n) + n; | ||
97 | +} | ||
98 | +#endif | ||
99 | + | ||
100 | /* | ||
101 | * Hack to support external-linkage inline functions | ||
102 | */ | ||
103 | -- | ||
104 | 2.40.0 | ||
diff --git a/meta/recipes-devtools/nasm/nasm_2.15.05.bb b/meta/recipes-devtools/nasm/nasm_2.15.05.bb index edc17aeebf..59b1121bd4 100644 --- a/meta/recipes-devtools/nasm/nasm_2.15.05.bb +++ b/meta/recipes-devtools/nasm/nasm_2.15.05.bb | |||
@@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=90904486f8fbf1861cf42752e1a39efe" | |||
8 | SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ | 8 | SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ |
9 | file://0001-stdlib-Add-strlcat.patch \ | 9 | file://0001-stdlib-Add-strlcat.patch \ |
10 | file://0002-Add-debug-prefix-map-option.patch \ | 10 | file://0002-Add-debug-prefix-map-option.patch \ |
11 | file://CVE-2022-44370.patch \ | ||
11 | " | 12 | " |
12 | 13 | ||
13 | SRC_URI[sha256sum] = "3c4b8339e5ab54b1bcb2316101f8985a5da50a3f9e504d43fa6f35668bee2fd0" | 14 | SRC_URI[sha256sum] = "3c4b8339e5ab54b1bcb2316101f8985a5da50a3f9e504d43fa6f35668bee2fd0" |