summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2015-12-05 18:57:48 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-01-20 17:08:29 (GMT)
commit6abe713244a5dd8dd02c9dfbddfcb5fe6d26fbbe (patch)
tree06bee4abad8e5bebf0f9cef160f8fb638b82032f
parent66740c331478297e5eaaa9357a31a9cf095cfd6f (diff)
downloadpoky-6abe713244a5dd8dd02c9dfbddfcb5fe6d26fbbe.tar.gz
libxml2: security fix CVE-2015-7497
(From OE-Core rev: 5b72983d1a6d5ad5e9a21d2673d57d1da2333ac6) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-core/libxml/libxml2.inc1
-rw-r--r--meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch40
2 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2.inc b/meta/recipes-core/libxml/libxml2.inc
index 759f722..7fadd2e 100644
--- a/meta/recipes-core/libxml/libxml2.inc
+++ b/meta/recipes-core/libxml/libxml2.inc
@@ -30,6 +30,7 @@ SRC_URI = "ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar \
30 file://CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch \ 30 file://CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch \
31 file://0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch \ 31 file://0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch \
32 file://CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch \ 32 file://CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch \
33 file://0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch \
33 " 34 "
34 35
35BINCONFIG = "${bindir}/xml2-config" 36BINCONFIG = "${bindir}/xml2-config"
diff --git a/meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch b/meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
new file mode 100644
index 0000000..955c961
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
@@ -0,0 +1,40 @@
1From 6360a31a84efe69d155ed96306b9a931a40beab9 Mon Sep 17 00:00:00 2001
2From: David Drysdale <drysdale@google.com>
3Date: Fri, 20 Nov 2015 10:47:12 +0800
4Subject: [PATCH] CVE-2015-7497 Avoid an heap buffer overflow in
5 xmlDictComputeFastQKey
6
7For https://bugzilla.gnome.org/show_bug.cgi?id=756528
8It was possible to hit a negative offset in the name indexing
9used to randomize the dictionary key generation
10Reported and fix provided by David Drysdale @ Google
11
12Upstream-Status: Backport
13
14CVE-2015-7497
15
16Signed-off-by: Armin Kuster <akuster@mvista.com>
17
18---
19 dict.c | 5 ++++-
20 1 file changed, 4 insertions(+), 1 deletion(-)
21
22diff --git a/dict.c b/dict.c
23index 5f71d55..8c8f931 100644
24--- a/dict.c
25+++ b/dict.c
26@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
27 value += 30 * (*prefix);
28
29 if (len > 10) {
30- value += name[len - (plen + 1 + 1)];
31+ int offset = len - (plen + 1 + 1);
32+ if (offset < 0)
33+ offset = len - (10 + 1);
34+ value += name[offset];
35 len = 10;
36 if (plen > 10)
37 plen = 10;
38--
392.3.5
40