diff options
Diffstat (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2019-17451.patch')
-rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2019-17451.patch | 46 |
1 files changed, 0 insertions, 46 deletions
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-17451.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-17451.patch deleted file mode 100644 index 1fe05d310e..0000000000 --- a/meta/recipes-devtools/binutils/binutils/CVE-2019-17451.patch +++ /dev/null | |||
@@ -1,46 +0,0 @@ | |||
1 | From 0192438051a7e781585647d5581a2a6f62fda362 Mon Sep 17 00:00:00 2001 | ||
2 | From: Alan Modra <amodra@gmail.com> | ||
3 | Date: Wed, 9 Oct 2019 10:47:13 +1030 | ||
4 | Subject: [PATCH] PR25070, SEGV in function _bfd_dwarf2_find_nearest_line | ||
5 | |||
6 | Selectively backporting fix for bfd/dwarf2.c, but not the ChangeLog | ||
7 | file. There are newer versions of binutils, but none of them contain the | ||
8 | commit fixing CVE-2019-17451, so backport it to master and zeus. | ||
9 | |||
10 | Upstream-Status: Backport | ||
11 | [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=336bfbeb1848] | ||
12 | CVE: CVE-2019-17451 | ||
13 | Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> | ||
14 | |||
15 | |||
16 | Evil testcase with two debug info sections, with sizes of 2aaaabac4ec1 | ||
17 | and ffffd5555453b140 result in a total size of 1. Reading the first | ||
18 | section of course overflows the buffer and tramples on other memory. | ||
19 | |||
20 | PR 25070 | ||
21 | * dwarf2.c (_bfd_dwarf2_slurp_debug_info): Catch overflow of | ||
22 | total_size calculation. | ||
23 | --- | ||
24 | bfd/dwarf2.c | 11 ++++++++++- | ||
25 | 1 file changed, 10 insertions(+), 1 deletion(-) | ||
26 | |||
27 | --- a/bfd/dwarf2.c | ||
28 | +++ b/bfd/dwarf2.c | ||
29 | @@ -4439,7 +4439,16 @@ _bfd_dwarf2_slurp_debug_info (bfd *abfd, | ||
30 | for (total_size = 0; | ||
31 | msec; | ||
32 | msec = find_debug_info (debug_bfd, debug_sections, msec)) | ||
33 | - total_size += msec->size; | ||
34 | + { | ||
35 | + /* Catch PR25070 testcase overflowing size calculation here. */ | ||
36 | + if (total_size + msec->size < total_size | ||
37 | + || total_size + msec->size < msec->size) | ||
38 | + { | ||
39 | + bfd_set_error (bfd_error_no_memory); | ||
40 | + return FALSE; | ||
41 | + } | ||
42 | + total_size += msec->size; | ||
43 | + } | ||
44 | |||
45 | stash->info_ptr_memory = (bfd_byte *) bfd_malloc (total_size); | ||
46 | if (stash->info_ptr_memory == NULL) | ||