summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/binutils
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/binutils')
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.28.inc1
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2017-9040_9042.patch57
2 files changed, 58 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.28.inc b/meta/recipes-devtools/binutils/binutils-2.28.inc
index b8199a42ff..c376433564 100644
--- a/meta/recipes-devtools/binutils/binutils-2.28.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.28.inc
@@ -53,6 +53,7 @@ SRC_URI = "\
53 file://CVE-2017-8421.patch \ 53 file://CVE-2017-8421.patch \
54 file://CVE-2017-9038_9044.patch \ 54 file://CVE-2017-9038_9044.patch \
55 file://CVE-2017-9039.patch \ 55 file://CVE-2017-9039.patch \
56 file://CVE-2017-9040_9042.patch \
56" 57"
57S = "${WORKDIR}/git" 58S = "${WORKDIR}/git"
58 59
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-9040_9042.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-9040_9042.patch
new file mode 100644
index 0000000000..79c6a7d8ab
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-9040_9042.patch
@@ -0,0 +1,57 @@
1From 7296a62a2a237f6b1ad8db8c38b090e9f592c8cf Mon Sep 17 00:00:00 2001
2From: Nick Clifton <nickc@redhat.com>
3Date: Thu, 13 Apr 2017 16:06:30 +0100
4Subject: [PATCH] readelf: fix out of range subtraction, seg fault from a NULL
5 pointer and memory exhaustion, all from parsing corrupt binaries.
6
7 PR binutils/21379
8 * readelf.c (process_dynamic_section): Detect over large section
9 offsets in the DT_SYMTAB entry.
10
11 PR binutils/21345
12 * readelf.c (process_mips_specific): Catch an unfeasible memory
13 allocation before it happens and print a suitable error message.
14
15Upstream-Status: Backport
16CVE: CVE-2017-9040
17CVE: CVE-2017-9042
18Signed-off-by: Armin Kuster <akuster@mvista.com>
19
20---
21 binutils/ChangeLog | 12 ++++++++++++
22 binutils/readelf.c | 26 +++++++++++++++++++++-----
23 2 files changed, 33 insertions(+), 5 deletions(-)
24
25Index: git/binutils/readelf.c
26===================================================================
27--- git.orig/binutils/readelf.c
28+++ git/binutils/readelf.c
29@@ -9306,6 +9306,12 @@ process_dynamic_section (FILE * file)
30 processing that. This is overkill, I know, but it
31 should work. */
32 section.sh_offset = offset_from_vma (file, entry->d_un.d_val, 0);
33+ if ((bfd_size_type) section.sh_offset > current_file_size)
34+ {
35+ /* See PR 21379 for a reproducer. */
36+ error (_("Invalid DT_SYMTAB entry: %lx"), (long) section.sh_offset);
37+ return FALSE;
38+ }
39
40 if (archive_file_offset != 0)
41 section.sh_size = archive_file_size - section.sh_offset;
42@@ -15175,6 +15181,15 @@ process_mips_specific (FILE * file)
43 return 0;
44 }
45
46+ /* PR 21345 - print a slightly more helpful error message
47+ if we are sure that the cmalloc will fail. */
48+ if (conflictsno * sizeof (* iconf) > current_file_size)
49+ {
50+ error (_("Overlarge number of conflicts detected: %lx\n"),
51+ (long) conflictsno);
52+ return FALSE;
53+ }
54+
55 iconf = (Elf32_Conflict *) cmalloc (conflictsno, sizeof (* iconf));
56 if (iconf == NULL)
57 {