Hello community, here is the log from the commit of package upx for openSUSE:Factory checked in at 2017-11-19 11:16:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/upx (Old) and /work/SRC/openSUSE:Factory/.upx.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "upx" Sun Nov 19 11:16:46 2017 rev:12 rq:542899 version:3.94 Changes: -------- --- /work/SRC/openSUSE:Factory/upx/upx.changes 2017-10-09 19:48:34.318658772 +0200 +++ /work/SRC/openSUSE:Factory/.upx.new/upx.changes 2017-11-19 11:16:54.923319718 +0100 @@ -1,0 +2,6 @@ +Sat Nov 18 09:56:22 UTC 2017 - [email protected] + +- Add 0001-Mach-o-defend-against-bad-crafted-input.patch + [CVE-2017-16869] [boo#1068681] + +------------------------------------------------------------------- New: ---- 0001-Mach-o-defend-against-bad-crafted-input.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ upx.spec ++++++ --- /var/tmp/diff_new_pack.Bj5NMn/_old 2017-11-19 11:16:56.171274381 +0100 +++ /var/tmp/diff_new_pack.Bj5NMn/_new 2017-11-19 11:16:56.171274381 +0100 @@ -35,6 +35,7 @@ Patch2: lzma-x-endian.patch Patch3: 0001-Protect-against-bad-crafted-input.patch Patch4: 0002-Protect-against-bad-crafted-input.patch +Patch5: 0001-Mach-o-defend-against-bad-crafted-input.patch %description UPX is a free, portable, extendable, high-performance executable packer @@ -53,6 +54,7 @@ popd %patch3 -p1 %patch4 -p1 +%patch5 -p1 # BSD-4 clause licensed file, remove just in case bnc#753791 rm src/stub/src/i386-dos32.djgpp2-stubify.asm ++++++ 0001-Mach-o-defend-against-bad-crafted-input.patch ++++++ >From 6eafa552bb4bf2303fbadf1f65e7d99919d476c6 Mon Sep 17 00:00:00 2001 From: John Reiser <[email protected]> X-From: did conflict resolution for applying to 3.94.0, <[email protected]> Date: Wed, 15 Nov 2017 13:38:54 -0800 Subject: [PATCH] Mach-o defend against bad crafted input https://github.com/upx/upx/issues/146 modified: p_mach.cpp --- src/p_mach.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) Index: upx-3.94-src/src/p_mach.cpp =================================================================== --- upx-3.94-src.orig/src/p_mach.cpp +++ upx-3.94-src/src/p_mach.cpp @@ -1835,6 +1835,12 @@ bool PackMachBase<T>::canPack() return false; my_cpusubtype = mhdri.cpusubtype; + unsigned int szx = mhdri.sizeofcmds; + unsigned headway = file_size - sizeof(mhdri); + if (headway < szx) { + char buf[32]; snprintf(buf, sizeof(buf), "bad sizeofcmds %u", szx); + throwCantPack(buf); + } rawmseg = (Mach_segment_command *)new char[(unsigned) mhdri.sizeofcmds]; fi->readx(rawmseg, mhdri.sizeofcmds); @@ -1843,11 +1849,18 @@ bool PackMachBase<T>::canPack() unsigned char const *ptr = (unsigned char const *)rawmseg; for (unsigned j= 0; j < ncmds; ++j) { Mach_segment_command const *segptr = (Mach_segment_command const *)ptr; + if (headway < ((Mach_command const *)ptr)->cmdsize) { + char buf[64]; snprintf(buf, sizeof(buf), + "bad Mach_command[%d]{%#x, %#x}", j, + (unsigned)segptr->cmd, (unsigned)((Mach_command const *)ptr)->cmdsize); + throwCantPack(buf); + } + headway -= ((Mach_command const *)ptr)->cmdsize; if (lc_seg == segptr->cmd) { msegcmd[j] = *segptr; } else { - memcpy(&msegcmd[j], ptr, 2*sizeof(unsigned)); // cmd and size + memcpy(&msegcmd[j], ptr, 2*sizeof(unsigned)); // cmd and cmdsize } switch (((Mach_uuid_command const *)ptr)->cmd) { default: break; @@ -1872,7 +1885,7 @@ bool PackMachBase<T>::canPack() prev_init_address = ((Mach_routines_command const *)ptr)->init_address; } - ptr += (unsigned) ((const Mach_segment_command *)ptr)->cmdsize; + ptr += (unsigned) ((Mach_command const *)ptr)->cmdsize; } if (Mach_header::MH_DYLIB==my_filetype && 0==o_routines_cmd) { infoWarning("missing -init function");
