mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-14 05:49:57 +00:00
Gyorgy Sarvari
5fb0376aed
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579
The patch was taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cc30757a7f)
40 lines
1.6 KiB
Diff
40 lines
1.6 KiB
Diff
From 81c1b7b0a28f052eaadddcb010944bf67e6ae257 Mon Sep 17 00:00:00 2001
|
|
From: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
Date: Sat, 15 Nov 2025 13:24:21 +0100
|
|
Subject: [PATCH] Make sure CPU feature parsing use large enough string buffer.
|
|
Fixes CVE-2023-29579.
|
|
|
|
Author: Petter Reinholdtsen <pere@debian.org>
|
|
Bug: https://github.com/yasm/yasm/issues/214
|
|
Bug-Debian: https://bugs.debian.org/1035951
|
|
Forwarded: https://github.com/yasm/yasm/issues/214
|
|
Last-Update: 2025-04-30
|
|
|
|
This patch is taken from Debian:
|
|
https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/
|
|
|
|
CVE: CVE-2023-29579
|
|
Upstream-Status: Submitted [https://github.com/yasm/yasm/issues/214]
|
|
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
modules/arch/x86/x86arch.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/modules/arch/x86/x86arch.c b/modules/arch/x86/x86arch.c
|
|
index bac11774..58327958 100644
|
|
--- a/modules/arch/x86/x86arch.c
|
|
+++ b/modules/arch/x86/x86arch.c
|
|
@@ -165,8 +165,9 @@ x86_dir_cpu(yasm_object *object, yasm_valparamhead *valparams,
|
|
yasm_error_set(YASM_ERROR_SYNTAX,
|
|
N_("invalid argument to [%s]"), "CPU");
|
|
else {
|
|
- char strcpu[16];
|
|
- sprintf(strcpu, "%lu", yasm_intnum_get_uint(intcpu));
|
|
+ char strcpu[21]; /* 21 = ceil(log10(LONG_MAX)+1) */
|
|
+ assert(8*sizeof(unsigned long) <= 64);
|
|
+ snprintf(strcpu, sizeof(strcpu), "%lu", yasm_intnum_get_uint(intcpu));
|
|
yasm_x86__parse_cpu(arch_x86, strcpu, strlen(strcpu));
|
|
}
|
|
} else
|