diff options
| author |   Changqing Li <changqing.li@windriver.com> | 2021-07-08 15:43:04 +0800 |
|---|---|---|
| committer |   Anuj Mittal <anuj.mittal@intel.com> | 2021-07-13 14:05:22 +0800 |
| commit | 9010ccd086c5895902308f6cf185c930ce63e5eb (patch) | |
| tree | 965b16d0699d3ac05eecc9a330c19b12afe1530c /meta | |
| parent | 2e3dff861ba5be445fd5ff34dd870b266af4f5e1 (diff) | |
| download | openembedded-core-contrib-9010ccd086c5895902308f6cf185c930ce63e5eb.tar.gz | |
libconvert-asn1-perl: fix CVE-2013-7488
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Diffstat (limited to 'meta')
| -rw-r--r-- | meta/recipes-extended/perl/libconvert-asn1-perl/CVE-2013-7488.patch | 35 | ||||
| -rw-r--r-- | meta/recipes-extended/perl/libconvert-asn1-perl_0.27.bb | 3 |
2 files changed, 37 insertions, 1 deletions
diff --git a/meta/recipes-extended/perl/libconvert-asn1-perl/CVE-2013-7488.patch b/meta/recipes-extended/perl/libconvert-asn1-perl/CVE-2013-7488.patch new file mode 100644 index 0000000000..d0aca65393 --- /dev/null +++ b/meta/recipes-extended/perl/libconvert-asn1-perl/CVE-2013-7488.patch @@ -0,0 +1,35 @@ +From 8070c6a4931801b6550c79c5766dfd3a99976036 Mon Sep 17 00:00:00 2001 +From: Changqing Li <changqing.li@windriver.com> +Date: Thu, 8 Jul 2021 14:48:36 +0800 +Subject: [PATCH] Merge pull request #15 from danaj/danaj/unsafe-decoding + +Upstream-Status: Backport[https://github.com/gbarr/perl-Convert-ASN1/commit/108e784417db7893f348c381c837537c3bd39373] +CVE: CVE-2013-7488 + +Signed-off-by: Changqing Li <changqing.li@windriver.com> +--- + lib/Convert/ASN1/_decode.pm | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm +index cd173f9..495e1bf 100644 +--- a/lib/Convert/ASN1/_decode.pm ++++ b/lib/Convert/ASN1/_decode.pm +@@ -683,12 +683,14 @@ sub _scan_indef { + $pos += 2; + next; + } ++ return if $pos >= $end; + + my $tag = substr($_[0], $pos++, 1); + + if((unpack("C",$tag) & 0x1f) == 0x1f) { + my $b; + do { ++ return if $pos >= $end; + $tag .= substr($_[0],$pos++,1); + $b = ord substr($tag,-1); + } while($b & 0x80); +-- +2.17.1 + diff --git a/meta/recipes-extended/perl/libconvert-asn1-perl_0.27.bb b/meta/recipes-extended/perl/libconvert-asn1-perl_0.27.bb index 409a8f3896..8ec96860ad 100644 --- a/meta/recipes-extended/perl/libconvert-asn1-perl_0.27.bb +++ b/meta/recipes-extended/perl/libconvert-asn1-perl_0.27.bb @@ -5,7 +5,8 @@ DESCRIPTION = "Convert::ASN1 is a perl library for encoding/decoding data using LICENSE = "Artistic-1.0 | GPL-1.0+" LIC_FILES_CHKSUM = "file://README.md;beginline=91;endline=97;md5=ceff7fd286eb6d8e8e0d3d23e096a63f" -SRC_URI = "http://search.cpan.org/CPAN/authors/id/G/GB/GBARR/Convert-ASN1-${PV}.tar.gz" +SRC_URI = "http://search.cpan.org/CPAN/authors/id/G/GB/GBARR/Convert-ASN1-${PV}.tar.gz \ + file://CVE-2013-7488.patch" SRC_URI[md5sum] = "68723e96be0b258a9e20480276e8a62c" SRC_URI[sha256sum] = "74a4a78ae0c5e973100ac0a8f203a110f76fb047b79dae4fc1fd7d6814d3d58a" |