[oe-commits] [openembedded-core] 35/65: binutls: Security fix for CVE-2017-16831
git at git.openembedded.org
git at git.openembedded.org
Wed Aug 15 09:23:39 UTC 2018
This is an automated email from the git hooks/post-receive script.
rpurdie pushed a commit to branch rocko
in repository openembedded-core.
commit ab9e8161a3b89914d8664175a684675bc99d6f21
Author: Armin Kuster <akuster at mvista.com>
AuthorDate: Tue Aug 7 16:16:58 2018 -0700
binutls: Security fix for CVE-2017-16831
Affects: <= 2.29.1
Signed-off-by: Armin Kuster <akuster at mvista.com>
---
meta/recipes-devtools/binutils/binutils-2.29.1.inc | 1 +
.../binutils/binutils/CVE-2017-16831.patch | 77 ++++++++++++++++++++++
2 files changed, 78 insertions(+)
diff --git a/meta/recipes-devtools/binutils/binutils-2.29.1.inc b/meta/recipes-devtools/binutils/binutils-2.29.1.inc
index 4191482..d5db6e8 100644
--- a/meta/recipes-devtools/binutils/binutils-2.29.1.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.29.1.inc
@@ -58,6 +58,7 @@ SRC_URI = "\
file://CVE-2017-16828_p2.patch \
file://CVE-2017-16829.patch \
file://CVE-2017-16830.patch \
+ file://CVE-2017-16831.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-16831.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-16831.patch
new file mode 100644
index 0000000..7acd5e0
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-16831.patch
@@ -0,0 +1,77 @@
+From 6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca Mon Sep 17 00:00:00 2001
+From: Nick Clifton <nickc at redhat.com>
+Date: Fri, 3 Nov 2017 11:55:21 +0000
+Subject: [PATCH] Fix excessive memory allocation attempts and possible integer
+ overfloaws when attempting to read a COFF binary with a corrupt symbol count.
+
+ PR 22385
+ * coffgen.c (_bfd_coff_get_external_symbols): Check for an
+ overlarge raw syment count.
+ (coff_get_normalized_symtab): Likewise.
+
+Upstream-Status: Backport
+Affects: <= 2.29.1
+CVE: CVE-2017-16831
+Signed-off-by: Armin Kuster <akuster at mvista.com>
+
+---
+ bfd/ChangeLog | 8 ++++++++
+ bfd/coffgen.c | 17 +++++++++++++++--
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog
++++ git/bfd/ChangeLog
+@@ -1,3 +1,11 @@
++2017-11-03 Mingi Cho <mgcho.minic at gmail.com>
++ Nick Clifton <nickc at redhat.com>
++
++ PR 22385
++ * coffgen.c (_bfd_coff_get_external_symbols): Check for an
++ overlarge raw syment count.
++ (coff_get_normalized_symtab): Likewise.
++
+ 2017-10-17 Alan Modra <amodra at gmail.com>
+
+ PR 22307
+Index: git/bfd/coffgen.c
+===================================================================
+--- git.orig/bfd/coffgen.c
++++ git/bfd/coffgen.c
+@@ -1640,13 +1640,23 @@ _bfd_coff_get_external_symbols (bfd *abf
+ size = obj_raw_syment_count (abfd) * symesz;
+ if (size == 0)
+ return TRUE;
++ /* Check for integer overflow and for unreasonable symbol counts. */
++ if (size < obj_raw_syment_count (abfd)
++ || (bfd_get_file_size (abfd) > 0
++ && size > bfd_get_file_size (abfd)))
++
++ {
++ _bfd_error_handler (_("%B: corrupt symbol count: %#Lx"),
++ abfd, obj_raw_syment_count (abfd));
++ return FALSE;
++ }
+
+ syms = bfd_malloc (size);
+ if (syms == NULL)
+ {
+ /* PR 21013: Provide an error message when the alloc fails. */
+- _bfd_error_handler (_("%B: Not enough memory to allocate space for %lu symbols"),
+- abfd, size);
++ _bfd_error_handler (_("%B: not enough memory to allocate space for %#Lx symbols of size %#Lx"),
++ abfd, obj_raw_syment_count (abfd), symesz);
+ return FALSE;
+ }
+
+@@ -1790,6 +1800,9 @@ coff_get_normalized_symtab (bfd *abfd)
+ return NULL;
+
+ size = obj_raw_syment_count (abfd) * sizeof (combined_entry_type);
++ /* Check for integer overflow. */
++ if (size < obj_raw_syment_count (abfd))
++ return NULL;
+ internal = (combined_entry_type *) bfd_zalloc (abfd, size);
+ if (internal == NULL && size != 0)
+ return NULL;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the Openembedded-commits
mailing list