Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33465
The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1020-hash-null-CVE-2021-33456.patch/ Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../yasm/yasm/CVE-2021-33456.patch | 35 +++++++++++++++++++ meta-oe/recipes-devtools/yasm/yasm_git.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-oe/recipes-devtools/yasm/yasm/CVE-2021-33456.patch diff --git a/meta-oe/recipes-devtools/yasm/yasm/CVE-2021-33456.patch b/meta-oe/recipes-devtools/yasm/yasm/CVE-2021-33456.patch new file mode 100644 index 0000000000..2340d8ed75 --- /dev/null +++ b/meta-oe/recipes-devtools/yasm/yasm/CVE-2021-33456.patch @@ -0,0 +1,35 @@ +From 1126140b8f5ece18c58640725f0e4c08e5ec97b0 Mon Sep 17 00:00:00 2001 +From: Gyorgy Sarvari <[email protected]> +Date: Sat, 15 Nov 2025 13:34:15 +0100 +Subject: [PATCH] A potential null pointer difference is that the return value + of the hash may be null. This fixes CVE-2021-33456. + +From: lixuebing <[email protected]> +Date: Mon, 25 Aug 2025 13:51:28 +0800 +Subject: Fix null-pointer-dereference in hash +Bug: https://github.com/yasm/yasm/issues/175 +Origin: https://github.com/yasm/yasm/pull/290 + +CVE: CVE-2021-33456 +Upstream-Status: Submitted [https://github.com/yasm/yasm/pull/290] + +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + modules/preprocs/nasm/nasm-pp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/modules/preprocs/nasm/nasm-pp.c b/modules/preprocs/nasm/nasm-pp.c +index f9f92dd1..473d98c1 100644 +--- a/modules/preprocs/nasm/nasm-pp.c ++++ b/modules/preprocs/nasm/nasm-pp.c +@@ -1102,6 +1102,10 @@ hash(char *s) + { + unsigned int h = 0; + unsigned int i = 0; ++ /* Check if the input string is NULL to avoid null pointer dereference */ ++ if (s == NULL) { ++ return 0; ++ } + /* + * Powers of three, mod 31. + */ diff --git a/meta-oe/recipes-devtools/yasm/yasm_git.bb b/meta-oe/recipes-devtools/yasm/yasm_git.bb index 9bd81c1dfd..6ddd94621a 100644 --- a/meta-oe/recipes-devtools/yasm/yasm_git.bb +++ b/meta-oe/recipes-devtools/yasm/yasm_git.bb @@ -16,6 +16,7 @@ SRC_URI = "git://github.com/yasm/yasm.git;branch=master;protocol=https \ file://0001-bitvect-fix-build-with-gcc-15.patch \ file://CVE-2023-29579.patch \ file://CVE-2021-33464.patch \ + file://CVE-2021-33456.patch \ "
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#121741): https://lists.openembedded.org/g/openembedded-devel/message/121741 Mute This Topic: https://lists.openembedded.org/mt/116311376/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
