diff options
Diffstat (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2019-9074.patch')
-rw-r--r-- | meta/recipes-devtools/binutils/binutils/CVE-2019-9074.patch | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-9074.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-9074.patch new file mode 100644 index 0000000000..a11a51200e --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2019-9074.patch | |||
@@ -0,0 +1,68 @@ | |||
1 | From e2ebb3906432dcca2727186ad79415f920730fb2 Mon Sep 17 00:00:00 2001 | ||
2 | From: Alan Modra <amodra@gmail.com> | ||
3 | Date: Tue, 19 Feb 2019 22:48:44 +1030 | ||
4 | Subject: [PATCH] PR24235, Read memory violation in pei-x86_64.c | ||
5 | |||
6 | PR 24235 | ||
7 | * pei-x86_64.c (pex64_bfd_print_pdata_section): Correct checks | ||
8 | attempting to prevent read past end of section. | ||
9 | |||
10 | Upstream-Status: Backport [https://github.com/bminor/binutils-gdb/commit/179f2db0d9c397d7dd8a59907b84208b79f7f48c] | ||
11 | CVE: CVE-2019-9074 | ||
12 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> | ||
13 | --- | ||
14 | bfd/ChangeLog | 6 ++++++ | ||
15 | bfd/pei-x86_64.c | 9 ++++----- | ||
16 | 2 files changed, 10 insertions(+), 5 deletions(-) | ||
17 | |||
18 | diff --git a/bfd/ChangeLog b/bfd/ChangeLog | ||
19 | index dd2c741..cbf30de 100644 | ||
20 | --- a/bfd/ChangeLog | ||
21 | +++ b/bfd/ChangeLog | ||
22 | @@ -1,3 +1,9 @@ | ||
23 | +2019-02-19 Alan Modra <amodra@gmail.com> | ||
24 | + | ||
25 | + PR 24235 | ||
26 | + * pei-x86_64.c (pex64_bfd_print_pdata_section): Correct checks | ||
27 | + attempting to prevent read past end of section. | ||
28 | + | ||
29 | 2019-02-04 Nick Clifton <nickc@redhat.com> | ||
30 | |||
31 | * development.sh (experimental) Set to false. | ||
32 | diff --git a/bfd/pei-x86_64.c b/bfd/pei-x86_64.c | ||
33 | index ff1093c..7e75104 100644 | ||
34 | --- a/bfd/pei-x86_64.c | ||
35 | +++ b/bfd/pei-x86_64.c | ||
36 | @@ -541,7 +541,7 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) | ||
37 | /* virt_size might be zero for objects. */ | ||
38 | if (stop == 0 && strcmp (abfd->xvec->name, "pe-x86-64") == 0) | ||
39 | { | ||
40 | - stop = (datasize / onaline) * onaline; | ||
41 | + stop = datasize; | ||
42 | virt_size_is_zero = TRUE; | ||
43 | } | ||
44 | else if (datasize < stop) | ||
45 | @@ -551,8 +551,8 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) | ||
46 | _("Warning: %s section size (%ld) is smaller than virtual size (%ld)\n"), | ||
47 | pdata_section->name, (unsigned long) datasize, | ||
48 | (unsigned long) stop); | ||
49 | - /* Be sure not to read passed datasize. */ | ||
50 | - stop = datasize / onaline; | ||
51 | + /* Be sure not to read past datasize. */ | ||
52 | + stop = datasize; | ||
53 | } | ||
54 | |||
55 | /* Display functions table. */ | ||
56 | @@ -724,8 +724,7 @@ pex64_bfd_print_pdata_section (bfd *abfd, void *vfile, asection *pdata_section) | ||
57 | altent += imagebase; | ||
58 | |||
59 | if (altent >= pdata_vma | ||
60 | - && (altent + PDATA_ROW_SIZE <= pdata_vma | ||
61 | - + pei_section_data (abfd, pdata_section)->virt_size)) | ||
62 | + && altent - pdata_vma + PDATA_ROW_SIZE <= stop) | ||
63 | { | ||
64 | pex64_get_runtime_function | ||
65 | (abfd, &arf, &pdata[altent - pdata_vma]); | ||
66 | -- | ||
67 | 2.7.4 | ||
68 | |||