aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch')
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch164
1 files changed, 164 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch
new file mode 100644
index 0000000000..26f4809cf0
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch
@@ -0,0 +1,164 @@
+From c1202057eb9161a86af27d867703235fee7b7555 Mon Sep 17 00:00:00 2001
+From: Nick Clifton <nickc@redhat.com>
+Date: Wed, 10 Apr 2019 15:49:36 +0100
+Subject: [PATCH] Pull in patch for libiberty that fixes a stack exhaustion bug
+ when demangling a pathalogically constructed mangled name.
+
+ PR 89394
+ * cp-demangle.c (cplus_demangle_fill_name): Reject negative
+ lengths.
+ (d_count_templates_scopes): Replace num_templates and num_scopes
+ parameters with a struct d_print_info pointer parameter. Adjust
+ body of the function accordingly. Add recursion counter and check
+ that the recursion limit is not reached.
+ (d_print_init): Pass dpi parameter to d_count_templates_scopes.
+ Reset recursion counter afterwards, unless the recursion limit was
+ reached.
+
+CVE: CVE-2019-9071
+Upstream-Status: Backport
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+---
+ ChangeLog | 16 ++++++++++++++
+ libiberty/cp-demangle.c | 48 ++++++++++++++++++++++-------------------
+ 2 files changed, 42 insertions(+), 22 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index cd631a15b6..4df3aaa62c 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,19 @@
++2019-04-10 Nick Clifton <nickc@redhat.com>
++
++ * libiberty: Sync with gcc. Bring in:
++ 2019-04-10 Nick Clifton <nickc@redhat.com>
++
++ PR 89394
++ * cp-demangle.c (cplus_demangle_fill_name): Reject negative
++ lengths.
++ (d_count_templates_scopes): Replace num_templates and num_scopes
++ parameters with a struct d_print_info pointer parameter. Adjust
++ body of the function accordingly. Add recursion counter and check
++ that the recursion limit is not reached.
++ (d_print_init): Pass dpi parameter to d_count_templates_scopes.
++ Reset recursion counter afterwards, unless the recursion limit was
++ reached.
++
+ 2018-06-24 Nick Clifton <nickc@redhat.com>
+
+ 2.32 branch created.
+diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
+index b34b485692..779b4e763a 100644
+--- a/libiberty/cp-demangle.c
++++ b/libiberty/cp-demangle.c
+@@ -861,7 +861,7 @@ CP_STATIC_IF_GLIBCPP_V3
+ int
+ cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
+ {
+- if (p == NULL || s == NULL || len == 0)
++ if (p == NULL || s == NULL || len <= 0)
+ return 0;
+ p->d_printing = 0;
+ p->type = DEMANGLE_COMPONENT_NAME;
+@@ -4061,7 +4061,7 @@ d_growable_string_callback_adapter (const char *s, size_t l, void *opaque)
+ are larger than the actual numbers encountered. */
+
+ static void
+-d_count_templates_scopes (int *num_templates, int *num_scopes,
++d_count_templates_scopes (struct d_print_info *dpi,
+ const struct demangle_component *dc)
+ {
+ if (dc == NULL)
+@@ -4081,13 +4081,13 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
+ break;
+
+ case DEMANGLE_COMPONENT_TEMPLATE:
+- (*num_templates)++;
++ dpi->num_copy_templates++;
+ goto recurse_left_right;
+
+ case DEMANGLE_COMPONENT_REFERENCE:
+ case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
+ if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
+- (*num_scopes)++;
++ dpi->num_saved_scopes++;
+ goto recurse_left_right;
+
+ case DEMANGLE_COMPONENT_QUAL_NAME:
+@@ -4152,42 +4152,42 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
+ case DEMANGLE_COMPONENT_TAGGED_NAME:
+ case DEMANGLE_COMPONENT_CLONE:
+ recurse_left_right:
+- d_count_templates_scopes (num_templates, num_scopes,
+- d_left (dc));
+- d_count_templates_scopes (num_templates, num_scopes,
+- d_right (dc));
++ /* PR 89394 - Check for too much recursion. */
++ if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
++ /* FIXME: There ought to be a way to report to the
++ user that the recursion limit has been reached. */
++ return;
++
++ ++ dpi->recursion;
++ d_count_templates_scopes (dpi, d_left (dc));
++ d_count_templates_scopes (dpi, d_right (dc));
++ -- dpi->recursion;
+ break;
+
+ case DEMANGLE_COMPONENT_CTOR:
+- d_count_templates_scopes (num_templates, num_scopes,
+- dc->u.s_ctor.name);
++ d_count_templates_scopes (dpi, dc->u.s_ctor.name);
+ break;
+
+ case DEMANGLE_COMPONENT_DTOR:
+- d_count_templates_scopes (num_templates, num_scopes,
+- dc->u.s_dtor.name);
++ d_count_templates_scopes (dpi, dc->u.s_dtor.name);
+ break;
+
+ case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
+- d_count_templates_scopes (num_templates, num_scopes,
+- dc->u.s_extended_operator.name);
++ d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
+ break;
+
+ case DEMANGLE_COMPONENT_FIXED_TYPE:
+- d_count_templates_scopes (num_templates, num_scopes,
+- dc->u.s_fixed.length);
++ d_count_templates_scopes (dpi, dc->u.s_fixed.length);
+ break;
+
+ case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
+ case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
+- d_count_templates_scopes (num_templates, num_scopes,
+- d_left (dc));
++ d_count_templates_scopes (dpi, d_left (dc));
+ break;
+
+ case DEMANGLE_COMPONENT_LAMBDA:
+ case DEMANGLE_COMPONENT_DEFAULT_ARG:
+- d_count_templates_scopes (num_templates, num_scopes,
+- dc->u.s_unary_num.sub);
++ d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
+ break;
+ }
+ }
+@@ -4222,8 +4222,12 @@ d_print_init (struct d_print_info *dpi, demangle_callbackref callback,
+ dpi->next_copy_template = 0;
+ dpi->num_copy_templates = 0;
+
+- d_count_templates_scopes (&dpi->num_copy_templates,
+- &dpi->num_saved_scopes, dc);
++ d_count_templates_scopes (dpi, dc);
++ /* If we did not reach the recursion limit, then reset the
++ current recursion value back to 0, so that we can print
++ the templates. */
++ if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
++ dpi->recursion = 0;
+ dpi->num_copy_templates *= dpi->num_saved_scopes;
+
+ dpi->current_template = NULL;
+--
+2.20.1
+