diff options
Diffstat (limited to 'meta/recipes-core/coreutils/coreutils-8.22/parse-datetime-CVE-2014-9471.patch')
-rw-r--r-- | meta/recipes-core/coreutils/coreutils-8.22/parse-datetime-CVE-2014-9471.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/meta/recipes-core/coreutils/coreutils-8.22/parse-datetime-CVE-2014-9471.patch b/meta/recipes-core/coreutils/coreutils-8.22/parse-datetime-CVE-2014-9471.patch new file mode 100644 index 0000000000..a094b8b54e --- /dev/null +++ b/meta/recipes-core/coreutils/coreutils-8.22/parse-datetime-CVE-2014-9471.patch | |||
@@ -0,0 +1,43 @@ | |||
1 | Upstream-Status: Backport | ||
2 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
3 | --- | ||
4 | diff -ruN a/ChangeLog b/ChangeLog | ||
5 | --- a/ChangeLog 2013-12-13 16:20:00.000000000 +0100 | ||
6 | +++ b/ChangeLog 2015-02-26 09:24:10.640577829 +0100 | ||
7 | @@ -1,3 +1,11 @@ | ||
8 | +2014-02-25 Sona Sarmadi <sona.sarmadi@enea.com> | ||
9 | + | ||
10 | + parse-datetime: fix crash or infloop in TZ="" parsing | ||
11 | + * lib/parse-datetime.y (parse_datetime): Break out of the | ||
12 | + TZ="" parsing loop once the second significant " is found. | ||
13 | + Also skip over any subsequent whitespace to be consistent | ||
14 | + with the non TZ= case (CVE-2014-9471) | ||
15 | + | ||
16 | 2013-12-13 Pádraig Brady <P@draigBrady.com> | ||
17 | |||
18 | version 8.22 | ||
19 | diff -ruN a/lib/parse-datetime.y b/lib/parse-datetime.y | ||
20 | --- a/lib/parse-datetime.y 2013-12-04 15:53:33.000000000 +0100 | ||
21 | +++ b/lib/parse-datetime.y 2015-02-26 09:20:15.238528670 +0100 | ||
22 | @@ -1303,8 +1303,6 @@ | ||
23 | char tz1buf[TZBUFSIZE]; | ||
24 | bool large_tz = TZBUFSIZE < tzsize; | ||
25 | bool setenv_ok; | ||
26 | - /* Free tz0, in case this is the 2nd or subsequent time through. */ | ||
27 | - free (tz0); | ||
28 | tz0 = get_tz (tz0buf); | ||
29 | z = tz1 = large_tz ? xmalloc (tzsize) : tz1buf; | ||
30 | for (s = tzbase; *s != '"'; s++) | ||
31 | @@ -1316,7 +1314,12 @@ | ||
32 | if (!setenv_ok) | ||
33 | goto fail; | ||
34 | tz_was_altered = true; | ||
35 | + | ||
36 | p = s + 1; | ||
37 | + while (c = *p, c_isspace (c)) | ||
38 | + p++; | ||
39 | + | ||
40 | + break; | ||
41 | } | ||
42 | } | ||
43 | |||