CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

uclibc: Security fix CVE-2016-2224

Browse Source 
CVE-2016-2224 Do not follow compressed items forever.

This change is being provide to comply to Yocto compatiblity.

(From OE-Core rev: 4fe0654253d7444f2c445a30b06623cef036b2bb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster 2016-02-10 15:42:34 -08:00 committed by Richard Purdie
parent ae57ea03c6
commit ef135112fd
2 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-core/uclibc/uclibc-git.inc
View File

@ -19,5 +19,6 @@ SRC_URI = "git://uclibc.org/uClibc.git;branch=master \
file://0001-gcc5-optimizes-away-the-write-only-static-functions-.patch \
file://0001-fcntl-Add-AT_EMPTY_PATH-for-all-and-O_PATH-for-arm.patch \
file://0001-wire-in-syncfs.patch \
file://CVE-2016-2224.patch \
"
S = "${WORKDIR}/git"

49
meta/recipes-core/uclibc/uclibc-git/CVE-2016-2224.patch Normal file
View File

@ -0,0 +1,49 @@
From 16719c1a7078421928e6d31dd1dec574825ef515 Mon Sep 17 00:00:00 2001
From: Waldemar Brodkorb <wbx@openadk.org>
Date: Sun, 17 Jan 2016 15:47:22 +0100
Subject: [PATCH] Do not follow compressed items forever.
It is possible to get stuck in an infinite loop when receiving a
specially crafted DNS reply. Exit the loop after a number of iteration
and consider the packet invalid.
Signed-off-by: Daniel Fahlgren <daniel@fahlgren.se>
Signed-off-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
Upstream-status: Backport
http://repo.or.cz/uclibc-ng.git/commit/16719c1a7078421928e6d31dd1dec574825ef515
CVE: CVE-2016-2224
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
libc/inet/resolv.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: git/libc/inet/resolv.c
===================================================================
--- git.orig/libc/inet/resolv.c
+++ git/libc/inet/resolv.c
@@ -666,11 +666,12 @@ int __decode_dotted(const unsigned char
bool measure = 1;
unsigned total = 0;
unsigned used = 0;
+ unsigned maxiter = 256;
if (!packet)
return -1;
- while (1) {
+ while (--maxiter) {
if (offset >= packet_len)
return -1;
b = packet[offset++];
@@ -707,6 +708,8 @@ int __decode_dotted(const unsigned char
else
dest[used++] = '\0';
}
+ if (!maxiter)
+ return -1;
/* The null byte must be counted too */
if (measure)