From 7e8bd02a57dbf3cb7d46960748fc27078fb98597 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 28 Aug 2015 15:12:04 +0200 Subject: icu: CVE-2014-8146-CVE-2014-8147 CVE-2014-8146 icu: heap overflow via incorrect isolateCount CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function References: [1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z [2] https://www.kb.cert.org/vuls/id/602540 [3] http://bugs.icu-project.org/trac/changeset/37080 [4] http://bugs.icu-project.org/trac/changeset/37162 (From OE-Core rev: a461a1a9141fb6a3f79bf9773a837daace2e9996) Signed-off-by: Sona Sarmadi Signed-off-by: Joshua Lock Signed-off-by: Richard Purdie --- .../icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch | 49 ++++++++++++++++++++++ meta/recipes-support/icu/icu_54.1.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch (limited to 'meta') diff --git a/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch new file mode 100644 index 0000000000..cf32d13ce5 --- /dev/null +++ b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch @@ -0,0 +1,49 @@ +ICU: CVE-2014-8146-CVE-2014-8147 + +CVE-2014-8146 icu: heap overflow via incorrect isolateCount +CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function + +References: +[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z +[2] https://www.kb.cert.org/vuls/id/602540 +[3] http://bugs.icu-project.org/trac/changeset/37080 +[4] http://bugs.icu-project.org/trac/changeset/37162 + +Upstream-Status: Backport + +Signed-off-by: Sona Sarmadi +--- +diff -ruN a/common/ubidi.c b/common/ubidi.c +--- a/common/ubidi.c 2014-10-03 18:11:20.000000000 +0200 ++++ b/common/ubidi.c 2015-08-28 08:22:39.455906194 +0200 +@@ -2138,7 +2138,7 @@ + /* The isolates[] entries contain enough information to + resume the bidi algorithm in the same state as it was + when it was interrupted by an isolate sequence. */ +- if(dirProps[start]==PDI) { ++ if(dirProps[start]==PDI && pBiDi->isolateCount >= 0) { + levState.startON=pBiDi->isolates[pBiDi->isolateCount].startON; + start1=pBiDi->isolates[pBiDi->isolateCount].start1; + stateImp=pBiDi->isolates[pBiDi->isolateCount].stateImp; +diff -ruN a/common/ubidiimp.h b/common/ubidiimp.h +--- a/common/ubidiimp.h 2014-10-03 18:11:16.000000000 +0200 ++++ b/common/ubidiimp.h 2015-08-28 08:28:24.069163845 +0200 +@@ -1,7 +1,7 @@ + /* + ****************************************************************************** + * +-* Copyright (C) 1999-2014, International Business Machines ++* Copyright (C) 1999-2015, International Business Machines + * Corporation and others. All Rights Reserved. + * + ****************************************************************************** +@@ -184,8 +184,8 @@ + typedef struct Isolate { + int32_t startON; + int32_t start1; ++ int32_t state; + int16_t stateImp; +- int16_t state; + } Isolate; + + typedef struct Run { diff --git a/meta/recipes-support/icu/icu_54.1.bb b/meta/recipes-support/icu/icu_54.1.bb index 45b5cb6001..9f10beb19c 100644 --- a/meta/recipes-support/icu/icu_54.1.bb +++ b/meta/recipes-support/icu/icu_54.1.bb @@ -11,6 +11,7 @@ ICU_PV = "${@icu_download_version(d)}" BASE_SRC_URI = "http://download.icu-project.org/files/icu4c/${PV}/icu4c-${ICU_PV}-src.tgz" SRC_URI = "${BASE_SRC_URI} \ file://icu-pkgdata-large-cmd.patch \ + file://icu-CVE-2014-8146-CVE-2014-8147.patch \ " SRC_URI_append_class-target = "\ -- cgit v1.2.3-54-g00ecf