summaryrefslogtreecommitdiffstats
path: root/meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch
diff options
context:
space:
mode:
authorKhem Raj <raj.khem@gmail.com>2017-04-21 20:36:06 +0000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2017-05-23 17:45:36 +0100
commit67d7ea7c675910f4da548639cdee31073cdf59fa (patch)
tree906556c4b75c4d25ccf78c245f522e771e5f55cb /meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch
parentf0ff93c2a5c709cada5fc34b328204a79a5d642f (diff)
downloadpoky-67d7ea7c675910f4da548639cdee31073cdf59fa.tar.gz
grub: Update to 2.02
Drop git recipe, add arm bits to 2.02 itself (From OE-Core rev: 4f27e4042dfb39caa71c7c6eb0a327de6af4d563) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch')
-rw-r--r--meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch53
1 files changed, 0 insertions, 53 deletions
diff --git a/meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch b/meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch
deleted file mode 100644
index 65ddcaf128..0000000000
--- a/meta/recipes-bsp/grub/files/0001-Fix-CVE-2015-8370-Grub2-user-pass-vulnerability.patch
+++ /dev/null
@@ -1,53 +0,0 @@
1Upstream-Status: Accepted
2CVE: CVE-2015-8370
3Signed-off-by: Awais Belal <awais_belal@mentor.com>
4
5From 451d80e52d851432e109771bb8febafca7a5f1f2 Mon Sep 17 00:00:00 2001
6From: Hector Marco-Gisbert <hecmargi@upv.es>
7Date: Wed, 16 Dec 2015 04:57:18 +0000
8Subject: Fix security issue when reading username and password
9
10This patch fixes two integer underflows at:
11 * grub-core/lib/crypto.c
12 * grub-core/normal/auth.c
13
14CVE-2015-8370
15
16Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
17Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
18Also-By: Andrey Borzenkov <arvidjaar@gmail.com>
19---
20diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
21index 010e550..683a8aa 100644
22--- a/grub-core/lib/crypto.c
23+++ b/grub-core/lib/crypto.c
24@@ -470,7 +470,8 @@ grub_password_get (char buf[], unsigned buf_size)
25
26 if (key == '\b')
27 {
28- cur_len--;
29+ if (cur_len)
30+ cur_len--;
31 continue;
32 }
33
34diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c
35index c6bd96e..8615c48 100644
36--- a/grub-core/normal/auth.c
37+++ b/grub-core/normal/auth.c
38@@ -174,8 +174,11 @@ grub_username_get (char buf[], unsigned buf_size)
39
40 if (key == '\b')
41 {
42- cur_len--;
43- grub_printf ("\b");
44+ if (cur_len)
45+ {
46+ cur_len--;
47+ grub_printf ("\b");
48+ }
49 continue;
50 }
51
52--
53cgit v0.9.0.2