summaryrefslogtreecommitdiff
path: root/system/binutils/CVE-2019-12972.patch
diff options
context:
space:
mode:
authorMax Rees <maxcrees@me.com>2019-08-01 03:15:42 -0500
committerMax Rees <maxcrees@me.com>2019-08-01 03:15:42 -0500
commit0a29ea8a1e1a794d19ba9f23ccc2836379419e18 (patch)
tree407c1ab5977afd63aa60c6bd7308439700178682 /system/binutils/CVE-2019-12972.patch
parentaddcb5d4b2d24c7927c597d156f5a31a3df2ab31 (diff)
downloadpackages-0a29ea8a1e1a794d19ba9f23ccc2836379419e18.tar.gz
packages-0a29ea8a1e1a794d19ba9f23ccc2836379419e18.tar.bz2
packages-0a29ea8a1e1a794d19ba9f23ccc2836379419e18.tar.xz
packages-0a29ea8a1e1a794d19ba9f23ccc2836379419e18.zip
system/binutils: patch multiple CVEs (#116)
Diffstat (limited to 'system/binutils/CVE-2019-12972.patch')
-rw-r--r--system/binutils/CVE-2019-12972.patch33
1 files changed, 33 insertions, 0 deletions
diff --git a/system/binutils/CVE-2019-12972.patch b/system/binutils/CVE-2019-12972.patch
new file mode 100644
index 000000000..82b41c014
--- /dev/null
+++ b/system/binutils/CVE-2019-12972.patch
@@ -0,0 +1,33 @@
+From 890f750a3b053532a4b839a2dd6243076de12031 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Fri, 21 Jun 2019 11:51:38 +0930
+Subject: [PATCH] PR24689, string table corruption
+
+The testcase in the PR had a e_shstrndx section of type SHT_GROUP.
+hdr->contents were initialized by setup_group rather than being read
+from the file, thus last byte was not zero and string dereference ran
+off the end of the buffer.
+
+ PR 24689
+ * elfcode.h (elf_object_p): Check type of e_shstrndx section.
+---
+ bfd/elfcode.h | 3 ++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/bfd/elfcode.h b/bfd/elfcode.h
+index a0487b0..5180f79 100644
+--- a/bfd/elfcode.h
++++ b/bfd/elfcode.h
+@@ -754,7 +754,8 @@ elf_object_p (bfd *abfd)
+ /* A further sanity check. */
+ if (i_ehdrp->e_shnum != 0)
+ {
+- if (i_ehdrp->e_shstrndx >= elf_numsections (abfd))
++ if (i_ehdrp->e_shstrndx >= elf_numsections (abfd)
++ || i_shdrp[i_ehdrp->e_shstrndx].sh_type != SHT_STRTAB)
+ {
+ /* PR 2257:
+ We used to just goto got_wrong_format_error here
+--
+2.9.3
+