Signed-off-by: Adrian Bunk <[email protected]> --- Already fixed in gpsd 3.19 in zeus and master. --- ...ck-in-in_escape-state-of-JSON-parser.patch | 46 +++++++++++++++++++ meta-oe/recipes-navigation/gpsd/gpsd_3.17.bb | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd-3.17/0001-Add-bounds-check-in-in_escape-state-of-JSON-parser.patch
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd-3.17/0001-Add-bounds-check-in-in_escape-state-of-JSON-parser.patch b/meta-oe/recipes-navigation/gpsd/gpsd-3.17/0001-Add-bounds-check-in-in_escape-state-of-JSON-parser.patch new file mode 100644 index 000000000..1a8a6ac0a --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd-3.17/0001-Add-bounds-check-in-in_escape-state-of-JSON-parser.patch @@ -0,0 +1,46 @@ +From a6e718c0dd32501c8961b6ac0493b148b6489f14 Mon Sep 17 00:00:00 2001 +From: "Eric S. Raymond" <[email protected]> +Date: Fri, 15 Jun 2018 13:26:28 -0400 +Subject: Add bounds check in in_escape state of JSON parser. + +CVE: CVE-2018-17937 +Upstream-Status: Backport +Signed-off-by: Adrian Bunk <[email protected]> + +--- + json.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/json.c b/json.c +index f5b59fba2..e7cac81fd 100644 +--- a/json.c ++++ b/json.c +@@ -374,6 +374,12 @@ static int json_internal_read_object(const char *cp, + if (pval == NULL) + /* don't update end here, leave at value start */ + return JSON_ERR_NULLPTR; ++ else if (pval > valbuf + JSON_VAL_MAX - 1 ++ || pval > valbuf + maxlen) { ++ json_debug_trace((1, "String value too long.\n")); ++ /* don't update end here, leave at value start */ ++ return JSON_ERR_STRLONG; /* */ ++ } + switch (*cp) { + case 'b': + *pval++ = '\b'; +@@ -394,8 +400,10 @@ static int json_internal_read_object(const char *cp, + for (n = 0; n < 4 && cp[n] != '\0'; n++) + uescape[n] = *cp++; + --cp; +- (void)sscanf(uescape, "%04x", &u); +- *pval++ = (char)u; /* will truncate values above 0xff */ ++ if (1 != sscanf(uescape, "%4x", &u)) { ++ return JSON_ERR_BADSTRING; ++ } ++ *pval++ = (unsigned char)u; /* will truncate values above 0xff */ + break; + default: /* handles double quote and solidus */ + *pval++ = *cp; +-- +2.20.1 + diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.17.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.17.bb index e823e42a5..488fa3a52 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.17.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.17.bb @@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ file://0001-SConstruct-prefix-includepy-with-sysroot-and-drop-sy.patch \ file://0004-SConstruct-disable-html-and-man-docs-building-becaus.patch \ file://0001-include-sys-ttydefaults.h.patch \ + file://0001-Add-bounds-check-in-in_escape-state-of-JSON-parser.patch \ " SRC_URI[md5sum] = "e0cfadcf4a65dfbdd2afb11c58f4e4a1" SRC_URI[sha256sum] = "68e0dbecfb5831997f8b3d6ba48aed812eb465d8c0089420ab68f9ce4d85e77a" -- 2.17.1 -- _______________________________________________ Openembedded-devel mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-devel
