summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSona Sarmadi <sona.sarmadi@enea.com>2015-09-04 10:51:00 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-09-19 10:53:16 (GMT)
commita01280b7ab323f415e91243ada46dc42b501116a (patch)
tree4b4b6e2a822e06aa973cee466ffc2617b627d131
parent800a3dc9b0ab28163433c35dbd87951cfe444166 (diff)
downloadpoky-a01280b7ab323f415e91243ada46dc42b501116a.tar.gz
icu: CVE-2014-8146-CVE-2014-8147
CVE-2014-8146 icu: heap overflow via incorrect isolateCount CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function References: [1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z [2] https://www.kb.cert.org/vuls/id/602540 [3] http://bugs.icu-project.org/trac/changeset/37080 [4] http://bugs.icu-project.org/trac/changeset/37162 (From OE-Core rev: 1bc6391f65dec41ff0360b625b7a85a161e43955) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch49
-rw-r--r--meta/recipes-support/icu/icu_53.1.bb1
2 files changed, 50 insertions, 0 deletions
diff --git a/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
new file mode 100644
index 0000000..2460357
--- /dev/null
+++ b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
@@ -0,0 +1,49 @@
1icu: CVE-2014-8146-CVE-2014-8147
2
3CVE-2014-8146 icu: heap overflow via incorrect isolateCount
4CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function
5
6References:
7[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
8[2] https://www.kb.cert.org/vuls/id/602540
9[3] http://bugs.icu-project.org/trac/changeset/37080
10[4] http://bugs.icu-project.org/trac/changeset/37162
11
12Upstream-Status: Backport
13
14Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
15---
16diff -ruN a/common/ubidi.c b/common/ubidi.c
17--- a/common/ubidi.c 2014-10-03 18:11:20.000000000 +0200
18+++ b/common/ubidi.c 2015-08-28 08:22:39.455906194 +0200
19@@ -2138,7 +2138,7 @@
20 /* The isolates[] entries contain enough information to
21 resume the bidi algorithm in the same state as it was
22 when it was interrupted by an isolate sequence. */
23- if(dirProps[start]==PDI) {
24+ if(dirProps[start]==PDI && pBiDi->isolateCount >= 0) {
25 levState.startON=pBiDi->isolates[pBiDi->isolateCount].startON;
26 start1=pBiDi->isolates[pBiDi->isolateCount].start1;
27 stateImp=pBiDi->isolates[pBiDi->isolateCount].stateImp;
28diff -ruN a/common/ubidiimp.h b/common/ubidiimp.h
29--- a/common/ubidiimp.h 2014-10-03 18:11:16.000000000 +0200
30+++ b/common/ubidiimp.h 2015-08-28 08:28:24.069163845 +0200
31@@ -1,7 +1,7 @@
32 /*
33 ******************************************************************************
34 *
35-* Copyright (C) 1999-2014, International Business Machines
36+* Copyright (C) 1999-2015, International Business Machines
37 * Corporation and others. All Rights Reserved.
38 *
39 ******************************************************************************
40@@ -184,8 +184,8 @@
41 typedef struct Isolate {
42 int32_t startON;
43 int32_t start1;
44+ int32_t state;
45 int16_t stateImp;
46- int16_t state;
47 } Isolate;
48
49 typedef struct Run {
diff --git a/meta/recipes-support/icu/icu_53.1.bb b/meta/recipes-support/icu/icu_53.1.bb
index d93af68..2906e8f 100644
--- a/meta/recipes-support/icu/icu_53.1.bb
+++ b/meta/recipes-support/icu/icu_53.1.bb
@@ -11,6 +11,7 @@ ICU_PV = "${@icu_download_version(d)}"
11BASE_SRC_URI = "http://download.icu-project.org/files/icu4c/${PV}/icu4c-${ICU_PV}-src.tgz" 11BASE_SRC_URI = "http://download.icu-project.org/files/icu4c/${PV}/icu4c-${ICU_PV}-src.tgz"
12SRC_URI = "${BASE_SRC_URI} \ 12SRC_URI = "${BASE_SRC_URI} \
13 file://icu-pkgdata-large-cmd.patch \ 13 file://icu-pkgdata-large-cmd.patch \
14 file://icu-CVE-2014-8146-CVE-2014-8147.patch \
14 " 15 "
15 16
16SRC_URI_append_class-target = "\ 17SRC_URI_append_class-target = "\