summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch')
-rw-r--r--meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch148
1 files changed, 148 insertions, 0 deletions
diff --git a/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch b/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch
new file mode 100644
index 0000000000..215a1715bf
--- /dev/null
+++ b/meta/recipes-devtools/elfutils/files/CVE-2019-7149.patch
@@ -0,0 +1,148 @@
1From 2562759d6fe5b364fe224852e64e8bda39eb2e35 Mon Sep 17 00:00:00 2001
2From: Mark Wielaard <mark@klomp.org>
3Date: Sun, 20 Jan 2019 22:10:18 +0100
4Subject: [PATCH] libdw: Check terminating NUL byte in dwarf_getsrclines for
5 dir/file table.
6
7For DWARF version < 5 the .debug_line directory and file tables consist
8of a terminating NUL byte after all strings. The code used to just skip
9this without checking it actually existed. This could case a spurious
10read past the end of data.
11
12Fix the same issue in readelf.
13
14https://sourceware.org/bugzilla/show_bug.cgi?id=24102
15
16Signed-off-by: Mark Wielaard <mark@klomp.org>
17
18Upstream-Status: Backport
19CVE: CVE-2019-7149
20Signed-off-by: Armin Kuster <akuster@mvista.com>
21
22---
23 libdw/ChangeLog | 5 +++++
24 libdw/dwarf_getsrclines.c | 11 ++++++++---
25 src/ChangeLog | 5 +++++
26 src/readelf.c | 8 ++++++--
27 4 files changed, 24 insertions(+), 5 deletions(-)
28
29Index: elfutils-0.175/libdw/dwarf_getsrclines.c
30===================================================================
31--- elfutils-0.175.orig/libdw/dwarf_getsrclines.c
32+++ elfutils-0.175/libdw/dwarf_getsrclines.c
33@@ -315,7 +315,7 @@ read_srclines (Dwarf *dbg,
34 if (version < 5)
35 {
36 const unsigned char *dirp = linep;
37- while (*dirp != 0)
38+ while (dirp < lineendp && *dirp != 0)
39 {
40 uint8_t *endp = memchr (dirp, '\0', lineendp - dirp);
41 if (endp == NULL)
42@@ -323,6 +323,8 @@ read_srclines (Dwarf *dbg,
43 ++ndirs;
44 dirp = endp + 1;
45 }
46+ if (dirp >= lineendp || *dirp != '\0')
47+ goto invalid_data;
48 ndirs = ndirs + 1; /* There is always the "unknown" dir. */
49 }
50 else
51@@ -392,11 +394,12 @@ read_srclines (Dwarf *dbg,
52 {
53 dirarray[n].dir = (char *) linep;
54 uint8_t *endp = memchr (linep, '\0', lineendp - linep);
55- assert (endp != NULL);
56+ assert (endp != NULL); // Checked above when calculating ndirlist.
57 dirarray[n].len = endp - linep;
58 linep = endp + 1;
59 }
60 /* Skip the final NUL byte. */
61+ assert (*linep == '\0'); // Checked above when calculating ndirlist.
62 ++linep;
63 }
64 else
65@@ -471,7 +474,7 @@ read_srclines (Dwarf *dbg,
66 {
67 if (unlikely (linep >= lineendp))
68 goto invalid_data;
69- while (*linep != 0)
70+ while (linep < lineendp && *linep != '\0')
71 {
72 struct filelist *new_file = NEW_FILE ();
73
74@@ -527,6 +530,8 @@ read_srclines (Dwarf *dbg,
75 goto invalid_data;
76 get_uleb128 (new_file->info.length, linep, lineendp);
77 }
78+ if (linep >= lineendp || *linep != '\0')
79+ goto invalid_data;
80 /* Skip the final NUL byte. */
81 ++linep;
82 }
83Index: elfutils-0.175/src/readelf.c
84===================================================================
85--- elfutils-0.175.orig/src/readelf.c
86+++ elfutils-0.175/src/readelf.c
87@@ -8444,7 +8444,7 @@ print_debug_line_section (Dwfl_Module *d
88 }
89 else
90 {
91- while (*linep != 0)
92+ while (linep < lineendp && *linep != 0)
93 {
94 unsigned char *endp = memchr (linep, '\0', lineendp - linep);
95 if (unlikely (endp == NULL))
96@@ -8454,6 +8454,8 @@ print_debug_line_section (Dwfl_Module *d
97
98 linep = endp + 1;
99 }
100+ if (linep >= lineendp || *linep != 0)
101+ goto invalid_unit;
102 /* Skip the final NUL byte. */
103 ++linep;
104 }
105@@ -8523,7 +8525,7 @@ print_debug_line_section (Dwfl_Module *d
106 else
107 {
108 puts (gettext (" Entry Dir Time Size Name"));
109- for (unsigned int cnt = 1; *linep != 0; ++cnt)
110+ for (unsigned int cnt = 1; linep < lineendp && *linep != 0; ++cnt)
111 {
112 /* First comes the file name. */
113 char *fname = (char *) linep;
114@@ -8553,6 +8555,8 @@ print_debug_line_section (Dwfl_Module *d
115 printf (" %-5u %-5u %-9u %-9u %s\n",
116 cnt, diridx, mtime, fsize, fname);
117 }
118+ if (linep >= lineendp || *linep != '\0')
119+ goto invalid_unit;
120 /* Skip the final NUL byte. */
121 ++linep;
122 }
123Index: elfutils-0.175/libdw/ChangeLog
124===================================================================
125--- elfutils-0.175.orig/libdw/ChangeLog
126+++ elfutils-0.175/libdw/ChangeLog
127@@ -1,3 +1,8 @@
128+2019-01-20 Mark Wielaard <mark@klomp.org>
129+
130+ * dwarf_getsrclines.c (read_srclines): Check terminating NUL byte
131+ for dir and file lists.
132+
133 2018-10-20 Mark Wielaard <mark@klomp.org>
134
135 * libdw.map (ELFUTILS_0.175): New section. Add dwelf_elf_begin.
136Index: elfutils-0.175/src/ChangeLog
137===================================================================
138--- elfutils-0.175.orig/src/ChangeLog
139+++ elfutils-0.175/src/ChangeLog
140@@ -1,3 +1,8 @@
141+2019-01-20 Mark Wielaard <mark@klomp.org>
142+
143+ * readelf.c (print_debug_line_section): Check terminating NUL byte
144+ for dir and file tables.
145+
146 2018-11-10 Mark Wielaard <mark@klomp.org>
147
148 * elflint.c (check_program_header): Allow PT_GNU_EH_FRAME segment
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-25 05:24:01 +0000