mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-15 16:07:26 +00:00
Roy Li
0fb90bef8c
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Conflicts: meta-oe/recipes-support/mysql/mariadb_5.5.39.inc
44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001
|
|
From: Roy Li <rongqing.li@windriver.com>
|
|
Date: Mon, 1 Jun 2015 15:31:48 +0800
|
|
Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17
|
|
00:00:00 2001 From: Gary Houston <ghouston@arglist.com> Date: Wed, 25 Feb
|
|
2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp
|
|
for excessively long pattern strings. CERT Vulnerability Note VU#695940.
|
|
Found by Guido Vranken.
|
|
|
|
Upsteam-Status: Backport
|
|
|
|
https://bugzilla.suse.com/attachment.cgi?id=627001
|
|
|
|
Signed-off-by: Roy Li <rongqing.li@windriver.com>
|
|
---
|
|
regex/regcomp.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/regex/regcomp.c b/regex/regcomp.c
|
|
index abc1817..31e57c1 100644
|
|
--- a/regex/regcomp.c
|
|
+++ b/regex/regcomp.c
|
|
@@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= {
|
|
(NC-1)*sizeof(cat_t));
|
|
if (g == NULL)
|
|
return(REG_ESPACE);
|
|
- p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */
|
|
+ {
|
|
+ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
|
|
+ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
|
|
+ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
|
|
+ free((char *) g);
|
|
+ return REG_INVARG;
|
|
+ }
|
|
+ p->ssize = new_ssize;
|
|
+ }
|
|
+
|
|
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
|
|
p->slen = 0;
|
|
if (p->strip == NULL) {
|
|
--
|
|
1.9.1
|
|
|