[oe-commits] [openembedded-core] 25/51: binutils: CVE-2017-8394
git at git.openembedded.org
git at git.openembedded.org
Sun Jan 7 17:11:34 UTC 2018
This is an automated email from the git hooks/post-receive script.
rpurdie pushed a commit to branch morty
in repository openembedded-core.
commit 0d6e08ffc4760947653ad9368d594074d506f697
Author: Thiruvadi Rajaraman <trajaraman at mvista.com>
AuthorDate: Wed Sep 20 13:22:09 2017 +0530
binutils: CVE-2017-8394
Source: git://sourceware.org/git/binutils-gdb.git
MR: 74166
Type: Security Fix
Disposition: Backport from binutils-2_29
ChangeID: d614742d33a55da6cafede60cd171766afb0aa1d
Description:
PR 21414, null pointer deref of _bfd_elf_large_com_section sym
PR 21414
* section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
* elf.c (lcomm_sym): New.
(_bfd_elf_large_com_section): Use lcomm_sym section symbol.
* bfd-in2.h: Regenerate.
Affects: <= 2.29
Author: Alan Modra <amodra at gmail.com>
Signed-off-by: Thiruvadi Rajaraman <trajaraman at mvista.com>
Reviewed-by: Armin Kuster <akuster at mvista.com>
Signed-off-by: Armin Kuster <akuster at mvista.com>
Signed-off-by: Armin Kuster <akuster808 at gmail.com>
---
meta/recipes-devtools/binutils/binutils-2.27.inc | 2 +
.../binutils/binutils/CVE-2017-8394.patch | 114 +++++++++++++++++++++
.../binutils/binutils/CVE-2017-8394_1.patch | 80 +++++++++++++++
3 files changed, 196 insertions(+)
diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc
index 3e514fc..a455b01 100644
--- a/meta/recipes-devtools/binutils/binutils-2.27.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.27.inc
@@ -73,6 +73,8 @@ SRC_URI = "\
file://CVE-2017-7300.patch \
file://CVE-2017-8396.patch \
file://CVE-2017-8421.patch \
+ file://CVE-2017-8394_1.patch \
+ file://CVE-2017-8394.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
new file mode 100644
index 0000000..14ee191
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch
@@ -0,0 +1,114 @@
+commit 7eacd66b086cabb1daab20890d5481894d4f56b2
+Author: Alan Modra <amodra at gmail.com>
+Date: Sun Apr 23 15:21:11 2017 +0930
+
+ PR 21414, null pointer deref of _bfd_elf_large_com_section sym
+
+ PR 21414
+ * section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
+ * elf.c (lcomm_sym): New.
+ (_bfd_elf_large_com_section): Use lcomm_sym section symbol.
+ * bfd-in2.h: Regenerate.
+
+Upstream-Status: Backport
+
+CVE: CVE-2017-8394
+Signed-off-by: Thiruvadi Rajaraman <trajaraman at mvista.com>
+
+Index: git/bfd/bfd-in2.h
+===================================================================
+--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:44.847475928 +0530
++++ git/bfd/bfd-in2.h 2017-09-20 12:54:44.903476171 +0530
+@@ -1805,6 +1805,18 @@
+ { NULL }, { NULL } \
+ }
+
++/* We use a macro to initialize the static asymbol structures because
++ traditional C does not permit us to initialize a union member while
++ gcc warns if we don't initialize it.
++ the_bfd, name, value, attr, section [, udata] */
++#ifdef __STDC__
++#define GLOBAL_SYM_INIT(NAME, SECTION) \
++ { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
++#else
++#define GLOBAL_SYM_INIT(NAME, SECTION) \
++ { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
++#endif
++
+ void bfd_section_list_clear (bfd *);
+
+ asection *bfd_get_section_by_name (bfd *abfd, const char *name);
+Index: git/bfd/section.c
+===================================================================
+--- git.orig/bfd/section.c 2017-09-20 12:54:44.847475928 +0530
++++ git/bfd/section.c 2017-09-20 12:54:44.903476171 +0530
+@@ -738,20 +738,20 @@
+ . { NULL }, { NULL } \
+ . }
+ .
++.{* We use a macro to initialize the static asymbol structures because
++. traditional C does not permit us to initialize a union member while
++. gcc warns if we don't initialize it.
++. the_bfd, name, value, attr, section [, udata] *}
++.#ifdef __STDC__
++.#define GLOBAL_SYM_INIT(NAME, SECTION) \
++. { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
++.#else
++.#define GLOBAL_SYM_INIT(NAME, SECTION) \
++. { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
++.#endif
++.
+ */
+
+-/* We use a macro to initialize the static asymbol structures because
+- traditional C does not permit us to initialize a union member while
+- gcc warns if we don't initialize it. */
+- /* the_bfd, name, value, attr, section [, udata] */
+-#ifdef __STDC__
+-#define GLOBAL_SYM_INIT(NAME, SECTION) \
+- { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }}
+-#else
+-#define GLOBAL_SYM_INIT(NAME, SECTION) \
+- { 0, NAME, 0, BSF_SECTION_SYM, SECTION }
+-#endif
+-
+ /* These symbols are global, not specific to any BFD. Therefore, anything
+ that tries to change them is broken, and should be repaired. */
+
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog 2017-09-20 12:54:44.735475444 +0530
++++ git/bfd/ChangeLog 2017-09-20 12:54:44.903476171 +0530
+@@ -102,6 +102,14 @@
+ * readelf.c (process_mips_specific): Remove null GOT data check.
+
+ 2017-04-23 Alan Modra <amodra at gmail.com>
++
++ PR 21414
++ * section.c (GLOBAL_SYM_INIT): Make available in bfd.h.
++ * elf.c (lcomm_sym): New.
++ (_bfd_elf_large_com_section): Use lcomm_sym section symbol.
++ * bfd-in2.h: Regenerate.
++
++2017-04-23 Alan Modra <amodra at gmail.com>
+
+ PR 21412
+ * elf-bfd.h (struct elf_backend_data <get_reloc_section>): Change
+Index: git/bfd/elf.c
+===================================================================
+--- git.orig/bfd/elf.c 2017-09-20 12:54:44.847475928 +0530
++++ git/bfd/elf.c 2017-09-20 13:00:22.636091768 +0530
+@@ -10986,9 +10986,11 @@
+
+ /* It is only used by x86-64 so far.
+ ??? This repeats *COM* id of zero. sec->id is supposed to be unique,
+- but current usage would allow all of _bfd_std_section to be zero. t*/
++ but current usage would allow all of _bfd_std_section to be zero. */
++static const asymbol lcomm_sym
++ = GLOBAL_SYM_INIT ("LARGE_COMMON", &_bfd_elf_large_com_section);
+ asection _bfd_elf_large_com_section
+- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
++ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, &lcomm_sym,
+ "LARGE_COMMON", 0, SEC_IS_COMMON);
+
+ void
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch
new file mode 100644
index 0000000..e1dfd8b
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch
@@ -0,0 +1,80 @@
+commit 821e6ff6299aa39e841ca50e1ae8a98e3554fd5f
+Author: Alan Modra <amodra at gmail.com>
+Date: Wed Oct 12 09:41:33 2016 +1030
+
+ BFD_FAKE_SECTION macro params
+
+ Order NAME, IDX, FLAGS as per STD_SECTION macro.
+
+ * section.c (BFD_FAKE_SECTION): Reorder parameters. Formatting.
+ (STD_SECTION): Adjust to suit.
+ * elf.c (_bfd_elf_large_com_section): Likewise.
+ * bfd-in2.h: Regenerate.
+
+Upstream-Status: Backport
+
+CVE: CVE-2017-8394
+Signed-off-by: Thiruvadi Rajaraman <trajaraman at mvista.com>
+
+
+Index: git/bfd/bfd-in2.h
+===================================================================
+--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:42.423465338 +0530
++++ git/bfd/bfd-in2.h 2017-09-20 13:02:48.000000000 +0530
+@@ -1767,9 +1767,9 @@
+ #define bfd_section_removed_from_list(ABFD, S) \
+ ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
+
+-#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
++#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
+ /* name, id, index, next, prev, flags, user_set_vma, */ \
+- { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
++ { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
+ \
+ /* linker_mark, linker_has_input, gc_mark, decompress_status, */ \
+ 0, 0, 1, 0, \
+Index: git/bfd/elf.c
+===================================================================
+--- git.orig/bfd/elf.c 2017-09-20 12:54:44.503474440 +0530
++++ git/bfd/elf.c 2017-09-20 13:02:48.000000000 +0530
+@@ -10984,10 +10984,12 @@
+ return n;
+ }
+
+-/* It is only used by x86-64 so far. */
++/* It is only used by x86-64 so far.
++ ??? This repeats *COM* id of zero. sec->id is supposed to be unique,
++ but current usage would allow all of _bfd_std_section to be zero. t*/
+ asection _bfd_elf_large_com_section
+- = BFD_FAKE_SECTION (_bfd_elf_large_com_section,
+- SEC_IS_COMMON, NULL, "LARGE_COMMON", 0);
++ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL,
++ "LARGE_COMMON", 0, SEC_IS_COMMON);
+
+ void
+ _bfd_elf_post_process_headers (bfd * abfd,
+Index: git/bfd/section.c
+===================================================================
+--- git.orig/bfd/section.c 2017-09-20 12:54:43.815471454 +0530
++++ git/bfd/section.c 2017-09-20 13:02:48.000000000 +0530
+@@ -700,9 +700,9 @@
+ .#define bfd_section_removed_from_list(ABFD, S) \
+ . ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S))
+ .
+-.#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \
++.#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \
+ . {* name, id, index, next, prev, flags, user_set_vma, *} \
+-. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
++. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \
+ . \
+ . {* linker_mark, linker_has_input, gc_mark, decompress_status, *} \
+ . 0, 0, 1, 0, \
+@@ -764,7 +764,7 @@
+ };
+
+ #define STD_SECTION(NAME, IDX, FLAGS) \
+- BFD_FAKE_SECTION(_bfd_std_section[IDX], FLAGS, &global_syms[IDX], NAME, IDX)
++ BFD_FAKE_SECTION(_bfd_std_section[IDX], &global_syms[IDX], NAME, IDX, FLAGS)
+
+ asection _bfd_std_section[] = {
+ STD_SECTION (BFD_COM_SECTION_NAME, 0, SEC_IS_COMMON),
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the Openembedded-commits
mailing list