mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-04 14:39:54 +00:00
Code Issues Projects Releases Wiki Activity

mariadb: Security Advisory -CVE-2015-2305

Browse Source 
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305

Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
This commit is contained in:
Roy Li
2015-06-01 16:04:16 +08:00
committed by Martin Jansa
parent a145099a9c
commit 4bcddcaccb
2 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/mysql/mariadb.inc
+1
View File
@@ -12,6 +12,7 @@ SRC_URI = "http://mirror.stshosting.co.uk/mariadb/mariadb-${PV}/source/mariadb-$
file://mysqld.service \ file://mysqld.service \
file://configure.cmake-fix-valgrind.patch \ file://configure.cmake-fix-valgrind.patch \
file://fix-a-building-failure.patch \ file://fix-a-building-failure.patch \
file://fix-CVE-2015-2305.patch \
" "
SRC_URI[md5sum] = "c8760d6b5890fc1de76c07af48092c88" SRC_URI[md5sum] = "c8760d6b5890fc1de76c07af48092c88"
meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch
+43
View File
@@ -0,0 +1,43 @@
From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Mon, 1 Jun 2015 15:31:48 +0800
Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17
00:00:00 2001 From: Gary Houston <ghouston@arglist.com> Date: Wed, 25 Feb
2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp
for excessively long pattern strings. CERT Vulnerability Note VU#695940.
Found by Guido Vranken.
Upsteam-Status: Backport
https://bugzilla.suse.com/attachment.cgi?id=627001
Signed-off-by: Roy Li <rongqing.li@windriver.com>
---
regex/regcomp.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/regex/regcomp.c b/regex/regcomp.c
index abc1817..31e57c1 100644
--- a/regex/regcomp.c
+++ b/regex/regcomp.c
@@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= {
(NC-1)*sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
- p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */
+ {
+ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+ free((char *) g);
+ return REG_INVARG;
+ }
+ p->ssize = new_ssize;
+ }
+
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {
--
1.9.1