From 538185bd1c0975dd865b9f185825577e3a4c42c2 Mon Sep 17 00:00:00 2001 From: Vivek Kumbhar Date: Fri, 21 Apr 2023 11:20:27 +0530 Subject: go: fix CVE-2023-24537 Infinite loop in parsing Setting a large line or column number using a //line directive can cause integer overflow even in small source files. Limit line and column numbers in //line directives to 2^30-1, which is small enough to avoid int32 overflow on all reasonbly-sized files. (From OE-Core rev: d1943e6a0ec00653c81cd4c0bb0d6b7e0909094c) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman --- meta/recipes-devtools/go/go-1.14.inc | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-devtools/go/go-1.14.inc') diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc index 7178739b7e..56f4f12c37 100644 --- a/meta/recipes-devtools/go/go-1.14.inc +++ b/meta/recipes-devtools/go/go-1.14.inc @@ -56,6 +56,7 @@ SRC_URI += "\ file://CVE-2022-41722-1.patch \ file://CVE-2022-41722-2.patch \ file://CVE-2020-29510.patch \ + file://CVE-2023-24537.patch \ " SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" -- cgit v1.2.3-54-g00ecf