summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-devtools/elfutils/elfutils_0.173.bb2
-rw-r--r--meta/recipes-devtools/elfutils/files/0001-libdw-Check-end-of-attributes-list-consistently.patch84
-rw-r--r--meta/recipes-devtools/elfutils/files/0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch59
3 files changed, 145 insertions, 0 deletions
diff --git a/meta/recipes-devtools/elfutils/elfutils_0.173.bb b/meta/recipes-devtools/elfutils/elfutils_0.173.bb
index 2fec73dbdb..00dab65607 100644
--- a/meta/recipes-devtools/elfutils/elfutils_0.173.bb
+++ b/meta/recipes-devtools/elfutils/elfutils_0.173.bb
@@ -29,6 +29,8 @@ SRC_URI = "https://sourceware.org/elfutils/ftp/${PV}/${BP}.tar.bz2 \
29 file://debian/0001-fix-gcc7-ftbfs.patch \ 29 file://debian/0001-fix-gcc7-ftbfs.patch \
30 file://debian/0001-disable_werror.patch \ 30 file://debian/0001-disable_werror.patch \
31 file://CVE-2018-16062.patch \ 31 file://CVE-2018-16062.patch \
32 file://0001-libdw-Check-end-of-attributes-list-consistently.patch \
33 file://0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch \
32 " 34 "
33SRC_URI_append_libc-musl = " file://0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch" 35SRC_URI_append_libc-musl = " file://0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch"
34 36
diff --git a/meta/recipes-devtools/elfutils/files/0001-libdw-Check-end-of-attributes-list-consistently.patch b/meta/recipes-devtools/elfutils/files/0001-libdw-Check-end-of-attributes-list-consistently.patch
new file mode 100644
index 0000000000..fb7f8b1780
--- /dev/null
+++ b/meta/recipes-devtools/elfutils/files/0001-libdw-Check-end-of-attributes-list-consistently.patch
@@ -0,0 +1,84 @@
1From 146456c537de5ac7c80608f88babbba026cca03b Mon Sep 17 00:00:00 2001
2From: Mark Wielaard <mark@klomp.org>
3Date: Sat, 18 Aug 2018 19:51:27 +0200
4Subject: [PATCH 1/2] libdw: Check end of attributes list consistently.
5
6dwarf_child (__libdw_find_attr), dwarf_getabbrevattr[_data] and
7dwarf_getattrs all assume the end of the attribute list is when
8both the name (code) and form of the attribute are zero.
9
10dwarf_getabbrev (__libdw_getabbrev) and dwarf_hasattr assume the
11end of the attribute list is when either the name (code) or the
12form of the attribute is zero.
13
14The DWARF spec says: "The series of attribute specifications ends
15with an entry containing 0 for the name and 0 for the form." So
16the first check is correct.
17
18Make sure dwarf_getabbrev and dwarf_hasattr use the same check.
19This is important since all other functions expect dwarf_getabbrev
20(__libdw_getabbrev) to have done a data sanity check of the attribute.
21So if the ending condition is different it could cause a crash.
22
23https://sourceware.org/bugzilla/show_bug.cgi?id=23529
24
25Signed-off-by: Mark Wielaard <mark@klomp.org>
26
27Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda]
28CVE: CVE-2018-16403
29
30Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
31---
32 libdw/ChangeLog | 7 +++++++
33 libdw/dwarf_getabbrev.c | 2 +-
34 libdw/dwarf_hasattr.c | 4 ++--
35 3 files changed, 10 insertions(+), 3 deletions(-)
36
37diff --git a/libdw/ChangeLog b/libdw/ChangeLog
38index 9e43ea9..f3cf5d3 100644
39--- a/libdw/ChangeLog
40+++ b/libdw/ChangeLog
41@@ -1,5 +1,12 @@
42 2018-08-18 Mark Wielaard <mark@klomp.org>
43
44+ * dwarf_getabbrev.c (__libdw_getabbrev): Continue until both name
45+ and form are zero.
46+ * dwarf_hasattr.c (dwarf_hasattr): Stop when both name and form
47+ are zero.
48+
49+2018-08-18 Mark Wielaard <mark@klomp.org>
50+
51 * dwarf_getaranges.c (dwarf_getaranges.c): Make sure there is enough
52 data to read the address and segment size.
53
54diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c
55index 988d12c..6a7e981 100644
56--- a/libdw/dwarf_getabbrev.c
57+++ b/libdw/dwarf_getabbrev.c
58@@ -140,7 +140,7 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset,
59 get_sleb128 (formval, abbrevp, end);
60 }
61 }
62- while (attrname != 0 && attrform != 0);
63+ while (attrname != 0 || attrform != 0);
64
65 /* Return the length to the caller if she asked for it. */
66 if (lengthp != NULL)
67diff --git a/libdw/dwarf_hasattr.c b/libdw/dwarf_hasattr.c
68index 90053b1..eca0839 100644
69--- a/libdw/dwarf_hasattr.c
70+++ b/libdw/dwarf_hasattr.c
71@@ -60,8 +60,8 @@ dwarf_hasattr (Dwarf_Die *die, unsigned int search_name)
72 unsigned int attr_form;
73 get_uleb128_unchecked (attr_form, attrp);
74
75- /* We can stop if we found the attribute with value zero. */
76- if (attr_name == 0 || attr_form == 0)
77+ /* We can stop if we found the end of the attribute list. */
78+ if (attr_name == 0 && attr_form == 0)
79 return 0;
80
81 if (attr_name == search_name)
82--
832.7.4
84
diff --git a/meta/recipes-devtools/elfutils/files/0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch b/meta/recipes-devtools/elfutils/files/0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch
new file mode 100644
index 0000000000..2465924acf
--- /dev/null
+++ b/meta/recipes-devtools/elfutils/files/0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch
@@ -0,0 +1,59 @@
1From d08572f7c9692c335afdb6f8dde48d77731209c3 Mon Sep 17 00:00:00 2001
2From: Mark Wielaard <mark@klomp.org>
3Date: Fri, 28 Sep 2018 10:45:56 +0800
4Subject: [PATCH 2/2] libelf: Return error if elf_compress_gnu is used on
5 SHF_COMPRESSED section.
6
7Compressing a section that is already compressed is fine, but useless.
8But it isn't possible to gnu compress (or decompress) a SHF_COMPRESSED
9section since there is no state kept that would tell if the section was
10first GNU compressed or first gabi compressed. Calling elf_compress_gnu
11on a section and then calling elf_compress on it to decompress it twice
12could cause a crash (the other way around is fine). Just disallow it.
13
14https://sourceware.org/bugzilla/show_bug.cgi?id=23528
15
16Signed-off-by: Mark Wielaard <mark@klomp.org>
17
18Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=56b18521fb8d46d40fc090c0de9d11a08bc982fa]
19CVE: CVE-2018-16402
20Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
21---
22 libelf/elf_compress_gnu.c | 4 +++-
23 libelf/libelf.h | 5 +++++
24 2 files changed, 8 insertions(+), 1 deletion(-)
25
26diff --git a/libelf/elf_compress_gnu.c b/libelf/elf_compress_gnu.c
27index c35dc39..dfa7c57 100644
28--- a/libelf/elf_compress_gnu.c
29+++ b/libelf/elf_compress_gnu.c
30@@ -80,7 +80,9 @@ elf_compress_gnu (Elf_Scn *scn, int inflate, unsigned int flags)
31 sh_addralign = shdr->sh_addralign;
32 }
33
34- if ((sh_flags & SHF_ALLOC) != 0)
35+ /* Allocated sections, or sections that are already are compressed
36+ cannot (also) be GNU compressed. */
37+ if ((sh_flags & SHF_ALLOC) != 0 || (sh_flags & SHF_COMPRESSED))
38 {
39 __libelf_seterrno (ELF_E_INVALID_SECTION_FLAGS);
40 return -1;
41diff --git a/libelf/libelf.h b/libelf/libelf.h
42index 547c0f5..fa568f7 100644
43--- a/libelf/libelf.h
44+++ b/libelf/libelf.h
45@@ -366,6 +366,11 @@ extern Elf64_Chdr *elf64_getchdr (Elf_Scn *__scn);
46 It is an error to request compression for a section that already
47 has SHF_COMPRESSED set, or (for elf_compress) to request
48 decompression for an section that doesn't have SHF_COMPRESSED set.
49+ If a section has SHF_COMPRESSED set then calling elf_compress_gnu
50+ will result in an error. The section has to be decompressed first
51+ using elf_compress. Calling elf_compress on a section compressed
52+ with elf_compress_gnu is fine, but probably useless.
53+
54 It is always an error to call these functions on SHT_NOBITS
55 sections or if the section has the SHF_ALLOC flag set.
56 elf_compress_gnu will not check whether the section name starts
57--
582.7.4
59