binutils: CVE-2017-7226

Source: git://sourceware.org/git/binutils-gdb.git
MR: 74283
Type: Security Fix
Disposition: Backport from binutils_v2_28
ChangeID: 82097a4b98d3d576e1b1bfb7ac9ae17fd153c909
Description:

Use strnlen to avoid running over the end of the string buffer.

Affects: <= 2.28

(From OE-Core rev: abc9e4eebafac084bee054954bd93288cd1d0a8c)

Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

2 files changed, 43 insertions, 0 deletions

diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc
index 3f8a5fe19c..3c29f660cd 100644
--- a/meta/recipes-devtools/binutils/binutils-2.27.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.27.inc
@@ -52,6 +52,7 @@ SRC_URI = "\
      file://CVE-2017-9040_and_9042.patch \
      file://CVE-2017-9041_1.patch \
      file://CVE-2017-9041_2.patch \
+     file://CVE-2017-7226.patch \
 "
 S  = "${WORKDIR}/git"
 
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-7226.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-7226.patch
new file mode 100644
index 0000000000..7525f34324
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-7226.patch
@@ -0,0 +1,42 @@
+Fix seg-fault in the binutils utilities when reading a corrupt input file.
+
+PR binutils/20905
+* peicode.h (pe_ILF_object_p): Use strnlen to avoid running over
+the end of the string buffer.
+
+Upstream-Status: Backport
+
+CVE: CVE-2017-7226
+Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
+
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog      2017-08-23 13:59:16.868424171 +0530
++++ git/bfd/ChangeLog   2017-08-23 14:03:22.683013823 +0530
+@@ -39,6 +39,12 @@
+        (bfd_elf_final_link): Only initialize the extended symbol index
+        section if there are extended symbol tables to list.
+ 
++2016-12-05  Nick Clifton  <nickc@redhat.com>
++ 
++       PR binutils/20905
++       * peicode.h (pe_ILF_object_p): Use strnlen to avoid running over
++       the end of the string buffer.
++
+ 2016-08-02  Nick Clifton  <nickc@redhat.com>
+ 
+        PR ld/17739
+Index: git/bfd/peicode.h
+===================================================================
+--- git.orig/bfd/peicode.h      2017-08-23 13:59:06.948319100 +0530
++++ git/bfd/peicode.h   2017-08-23 13:59:16.920424722 +0530
+@@ -1264,7 +1264,8 @@
+     }
+ 
+   symbol_name = (char *) ptr;
+-  source_dll  = symbol_name + strlen (symbol_name) + 1;
++  /* See PR 20905 for an example of where the strnlen is necessary.  */
++  source_dll  = symbol_name + strnlen (symbol_name, size - 1) + 1;
+ 
+   /* Verify that the strings are null terminated.  */
+   if (ptr[size - 1] != 0