openembedded-core.git/meta/recipes-extended/less, branch fido Mirror of openembedded-core less: fix CVE-2014-9488 2015-05-15T17:12:10+00:00 Junling Zheng zhengjunling@huawei.com 2015-04-24T05:58:59+00:00 7195d219f7af2b94dffb87a94077ec98dacdcdb0 An out of bounds read access in the UTF-8 decoding can be triggered with a malformed file in the tool less. The access happens in the function is_utf8_well_formed due to a truncated multibyte character in the sample file. The bug does not crash less, it can only be made visible by running less with valgrind or compiling it with Address Sanitizer. Version 475 of less contains a fix for this issue. The file version.c contains some entry mentioning this issue (without any credit): - v475 3/2/15 Fix possible buffer overrun with invalid UTF-8 The fix is in the file line.c. We derive this patch from: https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html Thank Claire Robinson for validating it on Mageia 4 i586. Refer to: https://bugs.mageia.org/show_bug.cgi?id=15567 (From OE-Core master rev: 68994284f3c059b737bfc5afc2600ebd09bdf47f) Signed-off-by: Junling Zheng <zhengjunling@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
An out of bounds read access in the UTF-8 decoding can be triggered with
a malformed file in the tool less. The access happens in the function
is_utf8_well_formed due to a truncated multibyte character in the sample
file.

The bug does not crash less, it can only be made visible by running less
with valgrind or compiling it with Address Sanitizer.

Version 475 of less contains a fix for this issue. The file version.c
contains some entry mentioning this issue (without any credit):

 - v475 3/2/15 Fix possible buffer overrun with invalid UTF-8

The fix is in the file line.c. We derive this patch from:

https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html

Thank Claire Robinson for validating it on Mageia 4 i586. Refer to:

https://bugs.mageia.org/show_bug.cgi?id=15567

(From OE-Core master rev: 68994284f3c059b737bfc5afc2600ebd09bdf47f)

Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: Upgrade to 471 2014-12-21T17:31:22+00:00 Chong Lu Chong.Lu@windriver.com 2014-12-19T05:41:59+00:00 0218dc4cb7a796e0e9653c9676beedbc7bf14542 Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: Upgrade to 470 2014-11-09T10:17:03+00:00 Saul Wold sgw@linux.intel.com 2014-11-07T00:19:41+00:00 f1fdcee974e04ece1830ecd539c7f217802df973 Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: Upgrade to 466 2014-08-31T22:39:10+00:00 Saul Wold sgw@linux.intel.com 2014-08-29T15:26:27+00:00 e0b9c83ade46f0f5332f4aef6a13dfa32733b387 Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: Update to 458 2013-04-29T13:43:51+00:00 Saul Wold sgw@linux.intel.com 2013-04-21T21:34:17+00:00 dd4f419413cf6ae1f8a069ae8a8cceae6ce02453 Signed-off-by: Saul Wold <sgw@linux.intel.com> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
less: Update to 457 2012-12-19T17:50:03+00:00 Saul Wold sgw@linux.intel.com 2012-12-14T03:03:16+00:00 8b4b9c1329c4bfd265ad4962aa61f5e61e10d1e7 Signed-off-by: Saul Wold <sgw@linux.intel.com> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
less: Update to 456 2012-12-03T14:42:07+00:00 Saul Wold sgw@linux.intel.com 2012-11-30T18:19:49+00:00 601338d8efce91ac89aa1d1fabd4d953f4f36f4b Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: Update to 451 2012-11-18T11:45:05+00:00 Saul Wold sgw@linux.intel.com 2012-11-14T05:32:45+00:00 4b6a70e60790a32d89e2e5cdded4af83e9d303ae LICENSE file was changed to match the BSD-2 Clause Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 
LICENSE file was changed to match the BSD-2 Clause

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
less: cleanup update-alternatives deprecated code 2012-08-15T13:18:41+00:00 Saul Wold sgw@linux.intel.com 2012-07-27T00:11:33+00:00 a8ad6529b214c1c7b12dffb557d9f7afa3ee1f04 Signed-off-by: Saul Wold <sgw@linux.intel.com> 
Signed-off-by: Saul Wold <sgw@linux.intel.com>
less: use BPN for alternatives 2012-05-30T09:43:42+00:00 Mark Hatle mark.hatle@windriver.com 2012-05-22T17:39:03+00:00 3361ebfd61dc0d5914a506b1a06b92bd80734114 Signed-off-by: Mark Hatle <mark.hatle@windriver.com> 
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>