mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-31 12:49:46 +00:00
Code Issues Projects Releases Wiki Activity

ruby: Secruity fix for CVE-2017-9226

Browse Source 
affects ruby < 2.4.1

(From OE-Core rev: 0c1eec0c6a789e1e9dbfcc66c3fb8c7d1d8b4e99)

Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Thiruvadi Rajaraman
2017-11-04 10:39:42 -07:00
committed by Richard Purdie
parent 7f7e00483a
commit 7039d1ad32
2 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/ruby/ruby/CVE-2017-9226.patch
+33
View File
@@ -0,0 +1,33 @@
commit f015fbdd95f76438cd86366467bb2b39870dd7c6
Author: K.Kosako <kosako@sofnec.co.jp>
Date: Fri May 19 15:44:47 2017 +0900
fix #55 : Byte value expressed in octal must be smaller than 256
Upstream-Status: Backport
CVE: CVE-2017-9226
Signed-off-by: Thiruvadi Rajaraman <tajaraman@mvista.com>
Index: ruby-2.2.5/regparse.c
===================================================================
--- ruby-2.2.5.orig/regparse.c 2017-09-12 16:33:21.977835068 +0530
+++ ruby-2.2.5/regparse.c 2017-09-12 16:34:40.987117744 +0530
@@ -3222,7 +3222,7 @@
PUNFETCH;
prev = p;
num = scan_unsigned_octal_number(&p, end, 3, enc);
- if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
if (p == prev) { /* can't read nothing. */
num = 0; /* but, it's not error */
}
@@ -3676,7 +3676,7 @@
if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
prev = p;
num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
- if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
if (p == prev) { /* can't read nothing. */
num = 0; /* but, it's not error */
}
meta/recipes-devtools/ruby/ruby_2.2.5.bb
+1
View File
@@ -7,6 +7,7 @@ SRC_URI += "file://prevent-gc.patch \
file://CVE-2016-7798.patch \
file://CVE-2017-9227.patch \
file://CVE-2017-9228.patch \
file://CVE-2017-9226.patch \
"
# it's unknown to configure script, but then passed to extconf.rb