diff options
| -rw-r--r-- | meta/recipes-connectivity/openssl/openssl/CVE-2016-2180.patch | 44 | ||||
| -rw-r--r-- | meta/recipes-connectivity/openssl/openssl_1.0.2h.bb | 1 |
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2016-2180.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2016-2180.patch new file mode 100644 index 0000000000..c71aaa5e51 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2016-2180.patch @@ -0,0 +1,44 @@ +From b746aa3fe05b5b5f7126df247ac3eceeb995e2a0 Mon Sep 17 00:00:00 2001 +From: "Dr. Stephen Henson" <steve@openssl.org> +Date: Thu, 21 Jul 2016 15:24:16 +0100 +Subject: [PATCH] Fix OOB read in TS_OBJ_print_bio(). + +TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result +as a null terminated buffer. The length value returned is the total +length the complete text reprsentation would need not the amount of +data written. + +CVE-2016-2180 + +Thanks to Shi Lei for reporting this bug. + +Reviewed-by: Matt Caswell <matt@openssl.org> +(cherry picked from commit 0ed26acce328ec16a3aa635f1ca37365e8c7403a) + +Upstream-Status: Backport +CVE: CVE-2016-2180 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + crypto/ts/ts_lib.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/crypto/ts/ts_lib.c b/crypto/ts/ts_lib.c +index c51538a..e0f1063 100644 +--- a/crypto/ts/ts_lib.c ++++ b/crypto/ts/ts_lib.c +@@ -90,9 +90,8 @@ int TS_OBJ_print_bio(BIO *bio, const ASN1_OBJECT *obj) + { + char obj_txt[128]; + +- int len = OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); +- BIO_write(bio, obj_txt, len); +- BIO_write(bio, "\n", 1); ++ OBJ_obj2txt(obj_txt, sizeof(obj_txt), obj, 0); ++ BIO_printf(bio, "%s\n", obj_txt); + + return 1; + } +-- +2.7.4 + diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb index 07cb0f9e85..764f1a2858 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb @@ -40,6 +40,7 @@ SRC_URI += "file://configure-targets.patch \ file://parallel.patch \ file://CVE-2016-2177.patch \ file://CVE-2016-2178.patch \ + file://CVE-2016-2180.patch \ " SRC_URI[md5sum] = "9392e65072ce4b614c1392eefc1f23d0" |