mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-02 01:19:52 +00:00
Code Issues Projects Releases Wiki Activity

binutls: Security fix CVE-2018-7208

Browse Source 
Affects <= 2.30

(From OE-Core rev: a994ef27a997bce0dd18f8e507b8d795b8111aeb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2018-08-05 21:59:02 -07:00
committed by Richard Purdie
parent e23d924838
commit 3db593919b
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/binutils/binutils-2.30.inc
+1
View File
@@ -40,6 +40,7 @@ SRC_URI = "\
file://CVE-2018-6872.patch \ file://CVE-2018-6872.patch \
file://CVE-2018-6759.patch \ file://CVE-2018-6759.patch \
file://CVE-2018-7642.patch \ file://CVE-2018-7642.patch \
file://CVE-2018-7208.patch \
" "
S = "${WORKDIR}/git" S = "${WORKDIR}/git"
meta/recipes-devtools/binutils/binutils/CVE-2018-7208.patch
+47
View File
@@ -0,0 +1,47 @@
From eb77f6a4621795367a39cdd30957903af9dbb815 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sat, 27 Jan 2018 08:19:33 +1030
Subject: [PATCH] PR22741, objcopy segfault on fuzzed COFF object
PR 22741
* coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
range before converting to a symbol table pointer.
Upstream-Status: Backport
Affects: Binutils <= 2.30
CVE: CVE-2018-7208
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
bfd/ChangeLog | 6 ++++++
bfd/coffgen.c | 3 ++-
2 files changed, 8 insertions(+), 1 deletion(-)
Index: git/bfd/coffgen.c
===================================================================
--- git.orig/bfd/coffgen.c
+++ git/bfd/coffgen.c
@@ -1555,7 +1555,8 @@ coff_pointerize_aux (bfd *abfd,
}
/* A negative tagndx is meaningless, but the SCO 3.2v4 cc can
generate one, so we must be careful to ignore it. */
- if (auxent->u.auxent.x_sym.x_tagndx.l > 0)
+ if ((unsigned long) auxent->u.auxent.x_sym.x_tagndx.l
+ < obj_raw_syment_count (abfd))
{
auxent->u.auxent.x_sym.x_tagndx.p =
table_base + auxent->u.auxent.x_sym.x_tagndx.l;
Index: git/bfd/ChangeLog
===================================================================
--- git.orig/bfd/ChangeLog
+++ git/bfd/ChangeLog
@@ -1,3 +1,9 @@
+2018-01-29 Alan Modra <amodra@gmail.com>
+
+ PR 22741
+ * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
+ range before converting to a symbol table pointer.
+
2018-02-28 Alan Modra <amodra@gmail.com>
PR 22887