CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

yasm: patch CVE-2023-29579

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579

The patch was taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2025-11-15 19:18:08 +01:00 committed by Khem Raj
parent 93f85e4fd2
commit cc30757a7f
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
meta-oe/recipes-devtools/yasm/yasm/CVE-2023-29579.patch Normal file
View File

@ -0,0 +1,39 @@
From 81c1b7b0a28f052eaadddcb010944bf67e6ae257 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Sat, 15 Nov 2025 13:24:21 +0100
Subject: [PATCH] Make sure CPU feature parsing use large enough string buffer.
Fixes CVE-2023-29579.
Author: Petter Reinholdtsen <pere@debian.org>
Bug: https://github.com/yasm/yasm/issues/214
Bug-Debian: https://bugs.debian.org/1035951
Forwarded: https://github.com/yasm/yasm/issues/214
Last-Update: 2025-04-30
This patch is taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/
CVE: CVE-2023-29579
Upstream-Status: Submitted [https://github.com/yasm/yasm/issues/214]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
modules/arch/x86/x86arch.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/modules/arch/x86/x86arch.c b/modules/arch/x86/x86arch.c
index bac11774..58327958 100644
--- a/modules/arch/x86/x86arch.c
+++ b/modules/arch/x86/x86arch.c
@@ -165,8 +165,9 @@ x86_dir_cpu(yasm_object *object, yasm_valparamhead *valparams,
yasm_error_set(YASM_ERROR_SYNTAX,
N_("invalid argument to [%s]"), "CPU");
else {
- char strcpu[16];
- sprintf(strcpu, "%lu", yasm_intnum_get_uint(intcpu));
+ char strcpu[21]; /* 21 = ceil(log10(LONG_MAX)+1) */
+ assert(8*sizeof(unsigned long) <= 64);
+ snprintf(strcpu, sizeof(strcpu), "%lu", yasm_intnum_get_uint(intcpu));
yasm_x86__parse_cpu(arch_x86, strcpu, strlen(strcpu));
}
} else

3
meta-oe/recipes-devtools/yasm/yasm_git.bb
View File

@ -14,7 +14,8 @@ SRC_URI = "git://github.com/yasm/yasm.git;branch=master;protocol=https \
file://0001-yasm-Set-build-date-to-SOURCE_DATE_EPOCH.patch \
file://0002-yasm-Use-BUILD_DATE-for-reproducibility.patch \
file://0001-bitvect-fix-build-with-gcc-15.patch \
"
file://CVE-2023-29579.patch \
"
inherit autotools gettext python3native