blob: 039166cfb94b6ee11926241001c1eca26586d39c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
commit 909e4e716c4d77e33357bbe9bc902bfaf2e1af24
Author: Nick Clifton <nickc@redhat.com>
Date: Wed Jul 19 14:49:12 2017 +0100
Fix use-after-free error when parsing a corrupt nested archive.
PR 21787
* archive.c (bfd_generic_archive_p): If the bfd does not have the
correct magic bytes at the start, set the error to wrong format
and clear the format selector before returning NULL.
Upstream-Status: Backport
CVE: CVE-2017-12448
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Index: git/bfd/archive.c
===================================================================
--- git.orig/bfd/archive.c 2017-08-30 16:44:10.848601412 +0530
+++ git/bfd/archive.c 2017-08-30 16:44:21.400855758 +0530
@@ -834,7 +834,12 @@
if (strncmp (armag, ARMAG, SARMAG) != 0
&& strncmp (armag, ARMAGB, SARMAG) != 0
&& ! bfd_is_thin_archive (abfd))
- return NULL;
+ {
+ bfd_set_error (bfd_error_wrong_format);
+ if (abfd->format == bfd_archive)
+ abfd->format = bfd_unknown;
+ return NULL;
+ }
tdata_hold = bfd_ardata (abfd);
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog 2017-08-30 16:44:21.340854320 +0530
+++ git/bfd/ChangeLog 2017-08-30 16:46:48.716143277 +0530
@@ -1,3 +1,10 @@
+2017-07-19 Nick Clifton <nickc@redhat.com>
+
+ PR 21787
+ * archive.c (bfd_generic_archive_p): If the bfd does not have the
+ correct magic bytes at the start, set the error to wrong format
+ and clear the format selector before returning NULL.
+
2017-04-25 Maciej W. Rozycki <macro@imgtec.com>
* readelf.c (process_mips_specific): Remove error reporting from
|