From dc5f155e159b1186cccc022f402a6af75e322916 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Wed, 10 Feb 2016 15:46:01 -0800 Subject: uclibc: Security fix CVE-2016-2225 CVE-2016-2225 Make sure to always terminate decoded string This change is being provide to comply to Yocto compatiblility. (From OE-Core rev: 093d76f3f4a385aae46304bd572ce1545c6bcf33) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- meta/recipes-core/uclibc/uclibc-git.inc | 1 + .../uclibc/uclibc-git/CVE-2016-2225.patch | 32 ++++++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-core/uclibc/uclibc-git/CVE-2016-2225.patch (limited to 'meta') diff --git a/meta/recipes-core/uclibc/uclibc-git.inc b/meta/recipes-core/uclibc/uclibc-git.inc index d3fb2a8a8e..b7184794d1 100644 --- a/meta/recipes-core/uclibc/uclibc-git.inc +++ b/meta/recipes-core/uclibc/uclibc-git.inc @@ -20,5 +20,6 @@ SRC_URI = "git://uclibc.org/uClibc.git;branch=master \ file://0001-fcntl-Add-AT_EMPTY_PATH-for-all-and-O_PATH-for-arm.patch \ file://0001-wire-in-syncfs.patch \ file://CVE-2016-2224.patch \ + file://CVE-2016-2225.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-core/uclibc/uclibc-git/CVE-2016-2225.patch b/meta/recipes-core/uclibc/uclibc-git/CVE-2016-2225.patch new file mode 100644 index 0000000000..0217e4bf55 --- /dev/null +++ b/meta/recipes-core/uclibc/uclibc-git/CVE-2016-2225.patch @@ -0,0 +1,32 @@ +From bb01edff0377f2585ce304ecbadcb7b6cde372ac Mon Sep 17 00:00:00 2001 +From: Waldemar Brodkorb +Date: Mon, 25 Jan 2016 21:11:34 +0100 +Subject: [PATCH] Make sure to always terminate decoded string + +Write a terminating '\0' to dest when the first byte of the encoded data +is 0. This corner case was previously missed. + +Signed-off-by: Daniel Fahlgren +Signed-off-by: Waldemar Brodkorb + +Upstream-Status: Backport +http://repo.or.cz/uclibc-ng.git/commit/bb01edff0377f2585ce304ecbadcb7b6cde372ac +CVE: CVE-2016-2225 +Signed-off-by: Armin Kuster + +--- + libc/inet/resolv.c | 1 + + 1 file changed, 1 insertion(+) + +Index: git/libc/inet/resolv.c +=================================================================== +--- git.orig/libc/inet/resolv.c ++++ git/libc/inet/resolv.c +@@ -671,6 +671,7 @@ int __decode_dotted(const unsigned char + if (!packet) + return -1; + ++ dest[0] = '\0'; + while (--maxiter) { + if (offset >= packet_len) + return -1; -- cgit v1.2.3-54-g00ecf