diff options
Diffstat (limited to 'meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch')
| -rw-r--r-- | meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch | 69 |
1 files changed, 0 insertions, 69 deletions
diff --git a/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch b/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch deleted file mode 100644 index 1a5d1eb996..0000000000 --- a/meta/recipes-bsp/u-boot/files/0001-CVE-2019-13103.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 39a759494f734c4cdc3e2b919671bfb3134b41ae Mon Sep 17 00:00:00 2001 -From: Paul Emge <paulemge@forallsecure.com> -Date: Mon, 8 Jul 2019 16:37:03 -0700 -Subject: [PATCH 1/9] CVE-2019-13103: disk: stop infinite recursion in DOS - Partitions - -part_get_info_extended and print_partition_extended can recurse infinitely -while parsing a self-referential filesystem or one with a silly number of -extended partitions. This patch adds a limit to the number of recursive -partitions. - -Signed-off-by: Paul Emge <paulemge@forallsecure.com> - -Upstream-Status: Backport[http://git.denx.de/?p=u-boot.git;a=commit; - h=232e2f4fd9a24bf08215ddc8c53ccadffc841fb5] - -CVE: CVE-2019-13103 - -Signed-off-by: Meng Li <Meng.Li@windriver.com> ---- - disk/part_dos.c | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/disk/part_dos.c b/disk/part_dos.c -index 936cee0d36..aae9d95906 100644 ---- a/disk/part_dos.c -+++ b/disk/part_dos.c -@@ -23,6 +23,10 @@ - - #define DOS_PART_DEFAULT_SECTOR 512 - -+/* should this be configurable? It looks like it's not very common at all -+ * to use large numbers of partitions */ -+#define MAX_EXT_PARTS 256 -+ - /* Convert char[4] in little endian format to the host format integer - */ - static inline unsigned int le32_to_int(unsigned char *le32) -@@ -126,6 +130,13 @@ static void print_partition_extended(struct blk_desc *dev_desc, - dos_partition_t *pt; - int i; - -+ /* set a maximum recursion level */ -+ if (part_num > MAX_EXT_PARTS) -+ { -+ printf("** Nested DOS partitions detected, stopping **\n"); -+ return; -+ } -+ - if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { - printf ("** Can't read partition table on %d:" LBAFU " **\n", - dev_desc->devnum, ext_part_sector); -@@ -191,6 +202,13 @@ static int part_get_info_extended(struct blk_desc *dev_desc, - int i; - int dos_type; - -+ /* set a maximum recursion level */ -+ if (part_num > MAX_EXT_PARTS) -+ { -+ printf("** Nested DOS partitions detected, stopping **\n"); -+ return -1; -+ } -+ - if (blk_dread(dev_desc, ext_part_sector, 1, (ulong *)buffer) != 1) { - printf ("** Can't read partition table on %d:" LBAFU " **\n", - dev_desc->devnum, ext_part_sector); --- -2.17.1 - |