[oe-commits] [openembedded-core] 35/51: binutils: CVE-2017-9753_and_CVE-2017-9754

[git at git.openembedded.org]

This is an automated email from the git hooks/post-receive script.

rpurdie pushed a commit to branch morty
in repository openembedded-core.

commit 7d46daa5e580e841f83b9070b3c84e87d8fd1181
Author: Thiruvadi Rajaraman <trajaraman at mvista.com>
AuthorDate: Thu Sep 21 19:28:06 2017 +0530

    binutils: CVE-2017-9753_and_CVE-2017-9754
    
    Source: binutils-gdb.git
    MR: 73958, 73945
    Type: Security Fix
    Disposition: Backport from binutils-2_29
    ChangeID: a39fdc82900af3f5d6ae396c913ac902f4ef7f60
    Description:
    
        Fix seg-faults in objdump when disassembling a corrupt versados binary.
    
            PR binutils/21591
            * versados.c (versados_mkobject): Zero the allocated tdata structure.
            (process_otr): Check for an invalid offset in the otr structure.
    
    Affects: <= 2.28
    Author: Nick Clifton <nickc at redhat.com>
    Signed-off-by: Thiruvadi Rajaraman <trajaraman at mvista.com>
    Reviewed-by: Armin Kuster <akuster at mvista.com>
    Signed-off-by: Armin Kuster <akuster at mvista.com>
    Signed-off-by: Armin Kuster <akuster808 at gmail.com>
---
 meta/recipes-devtools/binutils/binutils-2.27.inc   |  1 +
 .../binutils/binutils/CVE-2017-9753_9754.patch     | 76 ++++++++++++++++++++++
 2 files changed, 77 insertions(+)

diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc
index 54fb5d6..2b35cb1 100644
--- a/meta/recipes-devtools/binutils/binutils-2.27.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.27.inc
@@ -85,6 +85,7 @@ SRC_URI = "\
      file://CVE-2017-9747.patch \
      file://CVE-2017-9750.patch \
      file://CVE-2017-9752.patch \
+     file://CVE-2017-9753_9754.patch \
 "
 S  = "${WORKDIR}/git"
 
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch
new file mode 100644
index 0000000..fe1f9a1
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-9753_9754.patch
@@ -0,0 +1,76 @@
+commit 04f963fd489cae724a60140e13984415c205f4ac
+Author: Nick Clifton <nickc at redhat.com>
+Date:   Wed Jun 14 10:35:16 2017 +0100
+
+    Fix seg-faults in objdump when disassembling a corrupt versados binary.
+    
+    	PR binutils/21591
+    	* versados.c (versados_mkobject): Zero the allocated tdata structure.
+    	(process_otr): Check for an invalid offset in the otr structure.
+
+Upstream-Status: Backport
+
+CVE: CVE-2017-9753 and CVE-2017-9754
+Signed-off-by: Thiruvadi Rajaraman <trajaraman at mvista.com>
+
+Index: git/bfd/versados.c
+===================================================================
+--- git.orig/bfd/versados.c	2017-09-21 15:08:34.445197987 +0530
++++ git/bfd/versados.c	2017-09-21 15:08:34.429197878 +0530
+@@ -149,7 +149,7 @@
+   if (abfd->tdata.versados_data == NULL)
+     {
+       bfd_size_type amt = sizeof (tdata_type);
+-      tdata_type *tdata = bfd_alloc (abfd, amt);
++      tdata_type *tdata = bfd_zalloc (abfd, amt);
+ 
+       if (tdata == NULL)
+ 	return FALSE;
+@@ -344,13 +344,13 @@
+ };
+ 
+ static int
+-get_offset (int len, unsigned char *ptr)
++get_offset (unsigned int len, unsigned char *ptr)
+ {
+   int val = 0;
+ 
+   if (len)
+     {
+-      int i;
++      unsigned int i;
+ 
+       val = *ptr++;
+       if (val & 0x80)
+@@ -393,9 +393,13 @@
+ 	  int flag = *srcp++;
+ 	  int esdids = (flag >> 5) & 0x7;
+ 	  int sizeinwords = ((flag >> 3) & 1) ? 2 : 1;
+-	  int offsetlen = flag & 0x7;
++	  unsigned int offsetlen = flag & 0x7;
+ 	  int j;
+ 
++	  /* PR 21591: Check for invalid lengths.  */
++	  if (srcp + esdids + offsetlen >= endp)
++	    return;
++
+ 	  if (esdids == 0)
+ 	    {
+ 	      /* A zero esdid means the new pc is the offset given.  */
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog	2017-09-21 15:08:34.445197987 +0530
++++ git/bfd/ChangeLog	2017-09-21 15:08:34.429197878 +0530
+@@ -90,6 +90,12 @@
+ 	(_bfd_vms_slurp_etir): Add checks for attempts to read beyond the
+ 	end of etir record.
+ 
++2017-06-14  Nick Clifton  <nickc at redhat.com>
++
++	PR binutils/21591
++	* versados.c (versados_mkobject): Zero the allocated tdata structure.
++	(process_otr): Check for an invalid offset in the otr structure.
++
+ 2017-04-29  Alan Modra  <amodra at gmail.com>
+ 
+        PR 21432

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.