From: Armin Kuster <akus...@mvista.com>
Affects <= 2.30
Signed-off-by: Armin Kuster <akus...@mvista.com>
---
meta/recipes-devtools/binutils/binutils-2.30.inc | 1 +
.../binutils/binutils/CVE-2018-7568.patch | 85 ++++++++++++++++++++++
2 files changed, 86 insertions(+)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch
diff --git a/meta/recipes-devtools/binutils/binutils-2.30.inc
b/meta/recipes-devtools/binutils/binutils-2.30.inc
index 32eb44e..8995715 100644
--- a/meta/recipes-devtools/binutils/binutils-2.30.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.30.inc
@@ -42,6 +42,7 @@ SRC_URI = "\
file://CVE-2018-7642.patch \
file://CVE-2018-7208.patch \
file://CVE-2018-7569.patch \
+ file://CVE-2018-7568.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch
b/meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch
new file mode 100644
index 0000000..815b32c
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch
@@ -0,0 +1,85 @@
+From eef104664efb52965d85a28bc3fc7c77e52e48e2 Mon Sep 17 00:00:00 2001
+From: Nick Clifton <ni...@redhat.com>
+Date: Wed, 28 Feb 2018 10:13:54 +0000
+Subject: [PATCH] Fix potential integer overflow when reading corrupt dwarf1
+ debug information.
+
+ PR 22894
+ * dwarf1.c (parse_die): Check the length of form blocks before
+ advancing the data pointer.
+
+Upstream-Status: Backport
+Affects: Binutils <= 2.30
+CVE: CVE-2018-7568
+Signed-off-by: Armin Kuster <akus...@mvista.com>
+
+---
+ bfd/ChangeLog | 6 ++++++
+ bfd/dwarf1.c | 17 +++++++++++++++--
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+Index: git/bfd/dwarf1.c
+===================================================================
+--- git.orig/bfd/dwarf1.c
++++ git/bfd/dwarf1.c
+@@ -213,6 +213,7 @@ parse_die (bfd * abfd,
+ /* Then the attributes. */
+ while (xptr + 2 <= aDiePtrEnd)
+ {
++ unsigned int block_len;
+ unsigned short attr;
+
+ /* Parse the attribute based on its form. This section
+@@ -255,12 +256,24 @@ parse_die (bfd * abfd,
+ break;
+ case FORM_BLOCK2:
+ if (xptr + 2 <= aDiePtrEnd)
+- xptr += bfd_get_16 (abfd, xptr);
++ {
++ block_len = bfd_get_16 (abfd, xptr);
++ if (xptr + block_len > aDiePtrEnd
++ || xptr + block_len < xptr)
++ return FALSE;
++ xptr += block_len;
++ }
+ xptr += 2;
+ break;
+ case FORM_BLOCK4:
+ if (xptr + 4 <= aDiePtrEnd)
+- xptr += bfd_get_32 (abfd, xptr);
++ {
++ block_len = bfd_get_32 (abfd, xptr);
++ if (xptr + block_len > aDiePtrEnd
++ || xptr + block_len < xptr)
++ return FALSE;
++ xptr += block_len;
++ }
+ xptr += 4;
+ break;
+ case FORM_STRING:
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog
++++ git/bfd/ChangeLog
+@@ -4,7 +4,11 @@
+ * coffgen.c (coff_pointerize_aux): Ensure auxent tagndx is in
+ range before converting to a symbol table pointer.
+
+-2018-02-28 Alan Modra <amo...@gmail.com>
++2018-02-28 Nick Clifton <ni...@redhat.com>
++
++ PR 22894
++ * dwarf1.c (parse_die): Check the length of form blocks before
++ advancing the data pointer.
+
+ PR 22895
+ PR 22893
+@@ -14,6 +18,8 @@
+ size is invalid.
+ (read_attribute_value): Adjust invocations of read_n_bytes.
+
++2018-02-28 Alan Modra <amo...@gmail.com>
++
+ PR 22887
+ * aoutx.h (swap_std_reloc_in): Correct r_index bound check.
+
--
2.7.4
--
_______________________________________________
Openembedded-core mailing list
Openembedded-core@lists.openembedded.org
http://lists.openembedded.org/mailman/listinfo/openembedded-core
