aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoy Li <rongqing.li@windriver.com>2015-06-01 16:04:16 +0800
committerMartin Jansa <Martin.Jansa@gmail.com>2015-10-26 21:43:08 +0100
commit7ab203e051543edd730e6a630f47c5fcc846bd41 (patch)
treed1e1a283716383dd6b7118d3f5a5ee710d3210e5
parent763de0599bd61eae1c122782b03e12b66319a2f1 (diff)
downloadmeta-openembedded-7ab203e051543edd730e6a630f47c5fcc846bd41.tar.gz
meta-openembedded-7ab203e051543edd730e6a630f47c5fcc846bd41.tar.bz2
meta-openembedded-7ab203e051543edd730e6a630f47c5fcc846bd41.zip
mariadb: Security Advisory -CVE-2015-2305
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Conflicts: meta-oe/recipes-support/mysql/mariadb.inc removed ref to patch fix-a-building-failure.patch
-rw-r--r--meta-oe/recipes-support/mysql/mariadb.inc1
-rw-r--r--meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch43
2 files changed, 44 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/mysql/mariadb.inc b/meta-oe/recipes-support/mysql/mariadb.inc
index f385bfcda..34c59fef8 100644
--- a/meta-oe/recipes-support/mysql/mariadb.inc
+++ b/meta-oe/recipes-support/mysql/mariadb.inc
@@ -11,6 +11,7 @@ SRC_URI = "http://mirror.stshosting.co.uk/mariadb/mariadb-${PV}/source/mariadb-$
file://my.cnf \
file://mysqld.service \
file://configure.cmake-fix-valgrind.patch \
+ file://fix-CVE-2015-2305.patch \
"
SRC_URI[md5sum] = "d2415efc6a6d73d7a58f3c79bb42f2e8"
diff --git a/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch
new file mode 100644
index 000000000..2d1b46734
--- /dev/null
+++ b/meta-oe/recipes-support/mysql/mariadb/fix-CVE-2015-2305.patch
@@ -0,0 +1,43 @@
+From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001
+From: Roy Li <rongqing.li@windriver.com>
+Date: Mon, 1 Jun 2015 15:31:48 +0800
+Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17
+ 00:00:00 2001 From: Gary Houston <ghouston@arglist.com> Date: Wed, 25 Feb
+ 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp
+ for excessively long pattern strings. CERT Vulnerability Note VU#695940.
+ Found by Guido Vranken.
+
+Upsteam-Status: Backport
+
+https://bugzilla.suse.com/attachment.cgi?id=627001
+
+Signed-off-by: Roy Li <rongqing.li@windriver.com>
+---
+ regex/regcomp.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/regex/regcomp.c b/regex/regcomp.c
+index abc1817..31e57c1 100644
+--- a/regex/regcomp.c
++++ b/regex/regcomp.c
+@@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= {
+ (NC-1)*sizeof(cat_t));
+ if (g == NULL)
+ return(REG_ESPACE);
+- p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */
++ {
++ /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
++ size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
++ if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
++ free((char *) g);
++ return REG_INVARG;
++ }
++ p->ssize = new_ssize;
++ }
++
+ p->strip = (sop *)malloc(p->ssize * sizeof(sop));
+ p->slen = 0;
+ if (p->strip == NULL) {
+--
+1.9.1
+