<html><body>
<h3>Signed-off-by: Kevin Weng <t-keweng@microsoft.com></h3>
<pre>.../libcomps/libcomps/CVE-2019-3817.patch | 97 +++++++++++++++++++
.../recipes-devtools/libcomps/libcomps_git.bb | 1 +
2 files changed, 98 insertions(+)
create mode 100644 meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch</pre>
<p>diff --git a/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch b/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch new file mode 100644 index 0000000000..b8cfb3c4db --- /dev/null +++ b/meta/recipes-devtools/libcomps/libcomps/CVE-2019-3817.patch @@ -0,0 +1,97 @@ +From cea10cd1f2ef6bb4edaac0c1d46d47bf237c42b8 Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone <rschiron@redhat.com> +Date: Mon, 21 Jan 2019 18:11:42 +0100 +Subject: [PATCH] Fix UAF in comps_objmrtree_unite function + +The added field is not used at all in many places and it is probably the +left-over of some copy-paste. + +Upstream-Status: Backport +[<a href="https://u12060237.ct.sendgrid.net/wf/click?upn=ZUEdHBk4v9DOmlXxaQIXsoghc-2F9RlLvhcpOjxb9ovgnr4YRBxmwFECTTjPS9PgQV84-2BUSEk9vEIRrUewVY024DakCb8CoJOoQbEEuIx0JtI-3D_TE0Kxc-2FihH-2BEaJFZv0piOBm40-2F8jB5b-2FHzeWxsyZzZlOtbMQm4wqVCgNIpo7dsW-2F-2BMliwfLhRhehxDxQEVAVjz-2B7rA-2FJAENANhR-2F6MZPVT-2B51qhvqGET2Vty0BwL81IUeQiJJuk4zpE2Fg3QQXVWpDE6FNrhfgq5VY6L2pPS04PDp19o96ktLgvmwqmPp1h0mq44BE56gMNN69lPv7N4SpL24Mg8fGsZ-2F2Q2KfqiP6s7uodDz8TisRft4onVRDNa">https://github.com/rpm-software-management/libcomps/commit</a> +/e3a5d056633677959ad924a51758876d415e7046] + +CVE: CVE-2019-3817 + +Signed-off-by: Kevin Weng <t-keweng@microsoft.com> +--- + libcomps/src/comps_mradix.c | 2 — + libcomps/src/comps_objmradix.c | 2 — + libcomps/src/comps_objradix.c | 2 — + libcomps/src/comps_radix.c | 1 – + 4 files changed, 7 deletions(-) + +diff --git a/libcomps/src/comps_mradix.c b/libcomps/src/comps_mradix.c +index 338cb07..6ceb7c9 100644 +--- a/libcomps/src/comps_mradix.c ++++ b/libcomps/src/comps_mradix.c +@@ -177,7 +177,6 @@ void comps_mrtree_unite(COMPS_MRTree <strong>rt1, COMPS_MRTree <strong>rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -195,7 +194,6 @@ void comps_mrtree_unite(COMPS_MRTree *rt1, COMPS_MRTree *rt2) { + parent_pair = (struct Pair</strong>) it->data; + free(it); + +- pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_MRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_objmradix.c b/libcomps/src/comps_objmradix.c +index 9be6648..8771c89 100644 +--- a/libcomps/src/comps_objmradix.c ++++ b/libcomps/src/comps_objmradix.c +@@ -285,7 +285,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -303,7 +302,6 @@ void comps_objmrtree_unite(COMPS_ObjMRTree *rt1, COMPS_ObjMRTree *rt2) { + parent_pair = (struct Pair</strong>) it->data; + free(it); + +- pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_ObjMRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_objradix.c b/libcomps/src/comps_objradix.c +index a790270..0ebaf22 100644 +--- a/libcomps/src/comps_objradix.c ++++ b/libcomps/src/comps_objradix.c +@@ -692,7 +692,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +@@ -711,7 +710,6 @@ void comps_objrtree_unite(COMPS_ObjRTree *rt1, COMPS_ObjRTree *rt2) { + //printf("key-part:%s\n", parent_pair->key); + free(it); + +- //pair->added = 0; + for (it = tmp_subnodes->first; it != NULL; it=it->next) { + pair = malloc(sizeof(struct Pair)); + pair->subnodes = ((COMPS_ObjRTreeData*)it->data)->subnodes; +diff --git a/libcomps/src/comps_radix.c b/libcomps/src/comps_radix.c +index ada4fda..05dcaf2 100644 +--- a/libcomps/src/comps_radix.c ++++ b/libcomps/src/comps_radix.c +@@ -529,7 +529,6 @@ void comps_rtree_unite(COMPS_RTree *rt1, COMPS_RTree *rt2) { + struct Pair { + COMPS_HSList * subnodes; + char * key; +- char added; + } *pair, *parent_pair; + + pair = malloc(sizeof(struct Pair)); +-- +2.22.0 + diff --git a/meta/recipes-devtools/libcomps/libcomps_git.bb b/meta/recipes-devtools/libcomps/libcomps_git.bb index e69bf67729..b657f3377c 100644 --- a/meta/recipes-devtools/libcomps/libcomps_git.bb +++ b/meta/recipes-devtools/libcomps/libcomps_git.bb @@ -6,6 +6,7 @@ SRC_URI = "git://github.com/rpm-software-management/libcomps.git \</p>
<pre>file://0001-Do-not-set-PYTHON_INSTALL_DIR-by-running-python.patch \
file://0002-Set-library-installation-path-correctly.patch \
file://0001-Make-__comps_objmrtree_all-static-inline.patch \</pre>
<p>+ <a href="file://CVE-2019-3817.patch">file://CVE-2019-3817.patch</a> \</p>
<pre> "
PV = "0.1.8+git${SRCPV}"</pre>
<p>— 2.22.0</p>
<img src="https://u12060237.ct.sendgrid.net/wf/open?upn=TE0Kxc-2FihH-2BEaJFZv0piOBm40-2F8jB5b-2FHzeWxsyZzZlOtbMQm4wqVCgNIpo7dsW-2F-2BMliwfLhRhehxDxQEVAVjz-2B7rA-2FJAENANhR-2F6MZPVT8q9lYz12fX3gDBfifCOUCjA5FI-2BjwOsaO7N5lUu7WQV1GhlVwLuSPbzoML0Zucs7fT-2BMUrF7sGQFfDz4bH80ZxyXbKs1WrT2LsFWivvsEETN139CEyysTAO3h6vY4uRtpI5tD1yE65lGrABj9dBgtm" alt="" width="1" height="1" border="0" style="height:1px !important;width:1px !important;border-width:0 !important;margin-top:0 !important;margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !important;padding-left:0 !important;"/>
</body></html>