From 1188ce3e3fb6f70d9d5536e4d0e4a6ced651d8f0 Mon Sep 17 00:00:00 2001 From: Yuanjie Huang Date: Wed, 31 May 2017 01:37:59 -0700 Subject: binutils: fix CVE-2017-7210 CVE: CVE-2017-7210 [BZ 21157] -- https://sourceware.org/bugzilla/show_bug.cgi?id=21157 PR binutils/21157: Fix handling of corrupt STABS enum type strings. (From OE-Core rev: 066a7acc4c19a4ef3428d0a7c695a2b08f45bc14) Signed-off-by: Yuanjie Huang Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- meta/recipes-devtools/binutils/binutils-2.27.inc | 1 + .../binutils/binutils/CVE-2017-7210.patch | 71 ++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2017-7210.patch (limited to 'meta') diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc index 5dca05e898..0936d974d4 100644 --- a/meta/recipes-devtools/binutils/binutils-2.27.inc +++ b/meta/recipes-devtools/binutils/binutils-2.27.inc @@ -44,6 +44,7 @@ SRC_URI = "\ file://CVE-2017-6969.patch \ file://CVE-2017-6969_2.patch \ file://CVE-2017-7209.patch \ + file://CVE-2017-7210.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-7210.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-7210.patch new file mode 100644 index 0000000000..211d2bfd80 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-7210.patch @@ -0,0 +1,71 @@ +From 80958b04c91edcd41c42807225a7ad1b2a4ce0e6 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Tue, 14 Feb 2017 14:07:29 +0000 +Subject: Fix handling of corrupt STABS enum type strings. + + PR binutils/21157 + * stabs.c (parse_stab_enum_type): Check for corrupt NAME:VALUE + pairs. + (parse_number): Exit early if passed an empty string. + +CVE: CVE-2017-7210 +Upstream-Status: Backport [master] + +Signed-off-by: Yuanjie Huang +--- + binutils/ChangeLog | 7 +++++++ + binutils/stabs.c | 14 +++++++++++++- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/binutils/ChangeLog b/binutils/ChangeLog +index c4d8e60eca..2bae9ec587 100644 +--- a/binutils/ChangeLog ++++ b/binutils/ChangeLog +@@ -1,3 +1,10 @@ ++2017-02-14 Nick Clifton ++ ++ PR binutils/21157 ++ * stabs.c (parse_stab_enum_type): Check for corrupt NAME:VALUE ++ pairs. ++ (parse_number): Exit early if passed an empty string. ++ + 2017-02-13 Nick Clifton + + PR binutils/21135 +diff --git a/binutils/stabs.c b/binutils/stabs.c +index aebde7afe9..c425afe98e 100644 +--- a/binutils/stabs.c ++++ b/binutils/stabs.c +@@ -232,6 +232,10 @@ parse_number (const char **pp, bfd_boolean *poverflow) + + orig = *pp; + ++ /* Stop early if we are passed an empty string. */ ++ if (*orig == 0) ++ return (bfd_vma) 0; ++ + errno = 0; + ul = strtoul (*pp, (char **) pp, 0); + if (ul + 1 != 0 || errno == 0) +@@ -1975,9 +1979,17 @@ parse_stab_enum_type (void *dhandle, const char **pp) + bfd_signed_vma val; + + p = *pp; +- while (*p != ':') ++ while (*p != ':' && *p != 0) + ++p; + ++ if (*p == 0) ++ { ++ bad_stab (orig); ++ free (names); ++ free (values); ++ return DEBUG_TYPE_NULL; ++ } ++ + name = savestring (*pp, p - *pp); + + *pp = p + 1; +-- +2.11.0 + -- cgit v1.2.3-54-g00ecf