sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

less: fix CVE-2014-9488 

An out of bounds read access in the UTF-8 decoding can be triggered with
a malformed file in the tool less. The access happens in the function
is_utf8_well_formed due to a truncated multibyte character in the sample
file.

The bug does not crash less, it can only be made visible by running less
with valgrind or compiling it with Address Sanitizer.

Version 475 of less contains a fix for this issue. The file version.c
contains some entry mentioning this issue (without any credit):

 - v475 3/2/15 Fix possible buffer overrun with invalid UTF-8

The fix is in the file line.c. We derive this patch from:

https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html

Thank Claire Robinson for validating it on Mageia 4 i586. Refer to:

https://bugs.mageia.org/show_bug.cgi?id=15567

(From OE-Core rev: 68994284f3c059b737bfc5afc2600ebd09bdf47f)

Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Junling Zheng 2015-04-24 13:58:59 +08:00 committed by Richard Purdie
parent b6288432bf
commit 0a6e3a9d69
2 changed files with 52 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
meta/recipes-extended/less/less/0001-Fix-possible-buffer-overrun-with-invalid-UTF-8.patch Normal file
View File

@ -0,0 +1,49 @@
From e0a1add063a657b98611c94debb3631b8ffa36fe Mon Sep 17 00:00:00 2001
From: Junling Zheng <zhengjunling@huawei.com>
Date: Fri, 24 Apr 2015 11:24:04 +0800
Subject: [PATCH] Fix possible buffer overrun with invalid UTF-8
An out of bounds read access in the UTF-8 decoding can be triggered with
a malformed file in the tool less. The access happens in the function
is_utf8_well_formed due to a truncated multibyte character in the sample
file.
The bug does not crash less, it can only be made visible by running less
with valgrind or compiling it with Address Sanitizer.
Version 475 of less contains a fix for this issue. The file version.c
contains some entry mentioning this issue (without any credit):
- v475 3/2/15 Fix possible buffer overrun with invalid UTF-8
The fix is in the file line.c. We derive this patch from:
https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html
Thank Claire Robinson for validating it on Mageia 4 i586. Refer to:
https://bugs.mageia.org/show_bug.cgi?id=15567
Upstream Status: Backported
Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
---
line.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/line.c b/line.c
index 89495a3..474be2c 100644
--- a/line.c
+++ b/line.c
@@ -807,7 +807,7 @@ pappend(c, pos)
mbc_buf[mbc_buf_index++] = c;
if (mbc_buf_index < mbc_buf_len)
return (0);
- if (is_utf8_well_formed(mbc_buf))
+ if (is_utf8_well_formed(mbc_buf, mbc_buf_index))
r = do_append(get_wchar(mbc_buf), mbc_buf, mbc_pos);
else
/* Complete, but not shortest form, sequence. */
--
1.9.1

4
meta/recipes-extended/less/less_471.bb
View File

@ -24,7 +24,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
file://LICENSE;md5=866cc220f330b04ae4661fc3cdfedea7"
DEPENDS = "ncurses"
SRC_URI = "http://www.greenwoodsoftware.com/${BPN}/${BPN}-${PV}.tar.gz"
SRC_URI = "http://www.greenwoodsoftware.com/${BPN}/${BPN}-${PV}.tar.gz \
file://0001-Fix-possible-buffer-overrun-with-invalid-UTF-8.patch \
"
SRC_URI[md5sum] = "9a40d29a2d84b41f9f36d7dd90b4f950"
SRC_URI[sha256sum] = "37f613fa9a526378788d790a92217d59b523574cf7159f6538da8564b3fb27f8"