mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-31 12:49:46 +00:00
Code Issues Projects Releases Wiki Activity

sysstat: fix CVE-2019-16167

Browse Source 
This commit is another part of CVE-2019-16167, please see
https://github.com/sysstat/sysstat/issues/232.

(From OE-Core rev: 5c11937348debf57e3a87c7c6a6c0429fd756eca)

Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 586c045eb81b79200b46bf743f5d3fdb5f68c12d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Wenlin Kang
2019-10-15 15:27:43 +08:00
committed by Richard Purdie
parent ed29b7291d
commit 78e173090b
2 changed files with 49 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/sysstat/sysstat/0001-Fix-232-Memory-corruption-bug-due-to-Integer-Overflo.patch
+46
View File
@@ -0,0 +1,46 @@
From 603ae4ed8cd65abf0776ef7f68354a5c24a3411c Mon Sep 17 00:00:00 2001
From: Sebastien GODARD <sysstat@users.noreply.github.com>
Date: Tue, 15 Oct 2019 14:39:33 +0800
Subject: [PATCH] Fix #232: Memory corruption bug due to Integer Overflow in
remap_struct()
Try to avoid integer overflow when reading a corrupted binary datafile
with sadf.
Upstream-Status: Backport [https://github.com/sysstat/sysstat/commit/83fad9c895d1ac13f76af5883b7451b3302beef5]
CVE: CVE-2019-16167
Signed-off-by: Sebastien GODARD <sysstat@users.noreply.github.com>
Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com>
---
sa_common.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/sa_common.c b/sa_common.c
index 395c11c..cfa9007 100644
--- a/sa_common.c
+++ b/sa_common.c
@@ -1336,7 +1336,8 @@ int remap_struct(unsigned int gtypes_nr[], unsigned int ftypes_nr[],
/* Remap [unsigned] int fields */
d = gtypes_nr[1] - ftypes_nr[1];
if (d) {
- if (ftypes_nr[1] * UL_ALIGNMENT_WIDTH < ftypes_nr[1])
+ if (gtypes_nr[0] * ULL_ALIGNMENT_WIDTH +
+ ftypes_nr[1] * UL_ALIGNMENT_WIDTH < ftypes_nr[1])
/* Overflow */
return -1;
@@ -1365,7 +1366,9 @@ int remap_struct(unsigned int gtypes_nr[], unsigned int ftypes_nr[],
/* Remap possible fields (like strings of chars) following int fields */
d = gtypes_nr[2] - ftypes_nr[2];
if (d) {
- if (ftypes_nr[2] * U_ALIGNMENT_WIDTH < ftypes_nr[2])
+ if (gtypes_nr[0] * ULL_ALIGNMENT_WIDTH +
+ gtypes_nr[1] * UL_ALIGNMENT_WIDTH +
+ ftypes_nr[2] * U_ALIGNMENT_WIDTH < ftypes_nr[2])
/* Overflow */
return -1;
--
1.9.1
meta/recipes-extended/sysstat/sysstat_12.1.6.bb
+3 -1
View File
@@ -2,7 +2,9 @@ require sysstat.inc
LIC_FILES_CHKSUM = "file://COPYING;md5=a23a74b3f4caf9616230789d94217acb"
SRC_URI += "file://0001-Include-needed-headers-explicitly.patch"
SRC_URI += "file://0001-Include-needed-headers-explicitly.patch \
file://0001-Fix-232-Memory-corruption-bug-due-to-Integer-Overflo.patch \
"
SRC_URI[md5sum] = "d8e3bbb9c873dd370f6d33664e326570"
SRC_URI[sha256sum] = "f752f3c406153a6fc446496f1102872505ace3f0931d975c1d664c81ec09f129"