From patchwork Wed Mar 6 22:51:01 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 159763 Delivered-To: patch@linaro.org Received: by 2002:a02:5cc1:0:0:0:0:0 with SMTP id w62csp6733158jad; Wed, 6 Mar 2019 14:51:14 -0800 (PST) X-Google-Smtp-Source: APXvYqycvSFvrvIrHsS73gmHq25fWusMq8+DxpmwkHqTFHR83ozX/CiZ8bIxvzXTdVXQcSY48gij X-Received: by 2002:aa7:8a81:: with SMTP id a1mr9606291pfc.246.1551912674463; Wed, 06 Mar 2019 14:51:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551912674; cv=none; d=google.com; s=arc-20160816; b=ZXy9CQISV6Ot0J+BJQskI2h058k/aZJw+zDqrHIcRgSySCuRXkE3QNmYp0pEn45uUD arDyD3L/R6VPhvnud8WtjGeaM/iEn/m7CcdDvu3l3OTn59QTPcVdx3uWWHJYGjgyBnqW oO0Z9JpJN8yS2zsLMIfAEhecKncOvnxJn+5Q0Xyx6JH+FKdjps+/r086REPbO8nXnpKY /1iSAeg8bTqn5COQQlNVAXCaVTkzZbCQrTunx6do8S1/YnFCE9xbFZg6qanti+Aa/CR+ 5LURM6qj+zeWFDvA+ewfZxgNCpoysYCL4emt6rV/nVcgdqwNJJaCOrl0tA1ypsUfxwE3 xQ9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:dkim-signature :delivered-to; bh=k4cgU746R/Nru2WoHc8CvUkPkhixudrkRupT+2W8JcA=; b=JLWrB7hCJOhhC47t20M1/TSnizbmjl/swt/ThgkmgyLJBeokxYXHtteRryZSqdcVR0 mpo24IXaUOia1WdOVVh6S94+MtE60Ogk2WgyR8i5Zfrv6hvG7dB8rZ9ak87FwOYJkTG5 nBg57BKn+BjebyLH6siTp8Fh+gPRjmurjfxCNynJTe4phDwRL2/NFOEDAZ/TAyhIQOGY /RAewjGuUwsZw+kGKWIG/zPMpLCZCCe/mRV2CwbquUF6m/JPenQrZf97+nQqKXtgTqNF xQkXAMw53NMWZX3Eg8iuUTSC/JWthbYg4/SZv2rwdga+/Pf6drLDhur/A+smc3AO9m39 IbLQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=dd5tHkYx; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id c7si2520028plo.274.2019.03.06.14.51.13; Wed, 06 Mar 2019 14:51:14 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@intel-com.20150623.gappssmtp.com header.s=20150623 header.b=dd5tHkYx; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id 680607CE15; Wed, 6 Mar 2019 22:51:08 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-wm1-f67.google.com (mail-wm1-f67.google.com [209.85.128.67]) by mail.openembedded.org (Postfix) with ESMTP id 64BCE7CD9F for ; Wed, 6 Mar 2019 22:51:06 +0000 (UTC) Received: by mail-wm1-f67.google.com with SMTP id e74so7470574wmg.3 for ; Wed, 06 Mar 2019 14:51:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id; bh=5mr9AM43uZV/VyiFBrv+3WOA8EStbjC+Bgf2B0xH2go=; b=dd5tHkYxVd9Do5t8K3hbRpIUFzVbMZMl36eGNQRThd0V0w1azy7Fmtw9ZDjuSlqk0p k2VGiLVhmzUr7hl1Ny5+F0aj/3PC9zHHY4g1EM5JYO5cJn+Ja1ls6kL1cegpiprNVcu1 K4nL4rLihJC5V8yUYxx0CJthCByVGaJz2FATecqTaYWFgVQa3CrKy8j39EnBXV/UStGc 79yFXNul/5C4H3Y5Lcr+Gfm81EjM259VccvlFGQ3MUvniy5xprvNjIl7+u+0niOzYL+s UWDpLHn00M/lUqgz6dp1zddiaPZ/TPHuWl37mKRcGVwoVfJHamXmfhaf8lBAvFfMvMdE lYuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=5mr9AM43uZV/VyiFBrv+3WOA8EStbjC+Bgf2B0xH2go=; b=bl1b+58qir52Ca5h0txwlOQvL3rS6lXJ/R5fJ3ntEfeyl0p3zlm41kydViv3xQz/9R JampoO89YCXd7OrWhH+lf0b1BncaSUFMKbHMsSaEXG1CMmG1zkhsqAu7UeDnabShg19M m7c6Lp6lyy+8IdzotD+tFirIQHJ5DW8fLEiTQrz9bAq638UGplsBxbuUk9KBcXa3F2uC SaC29bscYQ16uY+GbqlIGAaCETK8GlIeCVle2zqGtJgTLzXO9R/vDney0LDz27dCBbML hlRGaz0lkVzOOCKPOmaV+KqCeaw7I5vD/52uBCSl1WODI3C9vnZLvpVObRpjKNhZpTcm oHuA== X-Gm-Message-State: APjAAAWLfVFOu1Uq/T77JAjio05p3w6ayqhtWQ6dZdg8PfKC+HwDVdUu /TxsjnP3t3hy5Ku0/NpAJJVj6XP/XCM= X-Received: by 2002:a1c:4006:: with SMTP id n6mr3924277wma.137.1551912666657; Wed, 06 Mar 2019 14:51:06 -0800 (PST) Received: from flashheart.burtonini.com (35.106.2.81.in-addr.arpa. [81.2.106.35]) by smtp.gmail.com with ESMTPSA id e193sm5033176wmg.18.2019.03.06.14.51.05 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Mar 2019 14:51:06 -0800 (PST) From: Ross Burton To: openembedded-core@lists.openembedded.org Date: Wed, 6 Mar 2019 22:51:01 +0000 Message-Id: <20190306225101.10727-1-ross.burton@intel.com> X-Mailer: git-send-email 2.11.0 Subject: [OE-core] [PATCH] libpcre2: fix CVE-2017-7186 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org Signed-off-by: Ross Burton --- .../libpcre/libpcre2/CVE-2017-7186.patch | 83 ++++++++++++++++++++++ meta/recipes-support/libpcre/libpcre2_10.32.bb | 1 + 2 files changed, 84 insertions(+) create mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2017-7186.patch -- 2.11.0 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-support/libpcre/libpcre2/CVE-2017-7186.patch b/meta/recipes-support/libpcre/libpcre2/CVE-2017-7186.patch new file mode 100644 index 00000000000..7cd7c27c6c0 --- /dev/null +++ b/meta/recipes-support/libpcre/libpcre2/CVE-2017-7186.patch @@ -0,0 +1,83 @@ +libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to +cause a denial of service (segmentation violation for read access, and +application crash) by triggering an invalid Unicode property lookup. + +CVE: CVE-2017-7186 +Upstream-Status: Backport +Signed-off-by: Ross Burton + +--- + src/pcre2_internal.h | 15 ++++++++++++++- + src/pcre2_ucd.c | 14 ++++++++++++++ + 2 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/pcre2_internal.h b/src/pcre2_internal.h +index 6a8774c..720bbc9 100644 +--- a/src/pcre2_internal.h ++++ b/src/pcre2_internal.h +@@ -1774,10 +1774,17 @@ typedef struct { + /* UCD access macros */ + + #define UCD_BLOCK_SIZE 128 +-#define GET_UCD(ch) (PRIV(ucd_records) + \ ++#define REAL_GET_UCD(ch) (PRIV(ucd_records) + \ + PRIV(ucd_stage2)[PRIV(ucd_stage1)[(int)(ch) / UCD_BLOCK_SIZE] * \ + UCD_BLOCK_SIZE + (int)(ch) % UCD_BLOCK_SIZE]) + ++#if PCRE2_CODE_UNIT_WIDTH == 32 ++#define GET_UCD(ch) ((ch > MAX_UTF_CODE_POINT)? \ ++ PRIV(dummy_ucd_record) : REAL_GET_UCD(ch)) ++#else ++#define GET_UCD(ch) REAL_GET_UCD(ch) ++#endif ++ + #define UCD_CHARTYPE(ch) GET_UCD(ch)->chartype + #define UCD_SCRIPT(ch) GET_UCD(ch)->script + #define UCD_CATEGORY(ch) PRIV(ucp_gentype)[UCD_CHARTYPE(ch)] +@@ -1834,6 +1841,9 @@ extern const uint8_t PRIV(utf8_table4)[]; + #define _pcre2_default_compile_context PCRE2_SUFFIX(_pcre2_default_compile_context_) + #define _pcre2_default_match_context PCRE2_SUFFIX(_pcre2_default_match_context_) + #define _pcre2_default_tables PCRE2_SUFFIX(_pcre2_default_tables_) ++#if PCRE2_CODE_UNIT_WIDTH == 32 ++#define _pcre2_dummy_ucd_record PCRE2_SUFFIX(_pcre2_dummy_ucd_record_) ++#endif + #define _pcre2_hspace_list PCRE2_SUFFIX(_pcre2_hspace_list_) + #define _pcre2_vspace_list PCRE2_SUFFIX(_pcre2_vspace_list_) + #define _pcre2_ucd_caseless_sets PCRE2_SUFFIX(_pcre2_ucd_caseless_sets_) +@@ -1858,6 +1868,9 @@ extern const uint32_t PRIV(hspace_list)[]; + extern const uint32_t PRIV(vspace_list)[]; + extern const uint32_t PRIV(ucd_caseless_sets)[]; + extern const ucd_record PRIV(ucd_records)[]; ++#if PCRE2_CODE_UNIT_WIDTH == 32 ++extern const ucd_record PRIV(dummy_ucd_record)[]; ++#endif + extern const uint8_t PRIV(ucd_stage1)[]; + extern const uint16_t PRIV(ucd_stage2)[]; + extern const uint32_t PRIV(ucp_gbtable)[]; +diff --git a/src/pcre2_ucd.c b/src/pcre2_ucd.c +index 116f537..56aa29d 100644 +--- a/src/pcre2_ucd.c ++++ b/src/pcre2_ucd.c +@@ -41,6 +41,20 @@ const uint32_t PRIV(ucd_caseless_sets)[] = {0}; + + const char *PRIV(unicode_version) = "8.0.0"; + ++/* If the 32-bit library is run in non-32-bit mode, character values ++greater than 0x10ffff may be encountered. For these we set up a ++special record. */ ++ ++#if PCRE2_CODE_UNIT_WIDTH == 32 ++const ucd_record PRIV(dummy_ucd_record)[] = {{ ++ ucp_Common, /* script */ ++ ucp_Cn, /* type unassigned */ ++ ucp_gbOther, /* grapheme break property */ ++ 0, /* case set */ ++ 0, /* other case */ ++ }}; ++#endif ++ + /* When recompiling tables with a new Unicode version, please check the + types in this structure definition from pcre2_internal.h (the actual + field names will be different): +-- +2.12.1 diff --git a/meta/recipes-support/libpcre/libpcre2_10.32.bb b/meta/recipes-support/libpcre/libpcre2_10.32.bb index 3a0aa53029f..59953626c74 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.32.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.32.bb @@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENCE;md5=cf66d307bf03bae65d413eb7a8e603a0" SRC_URI = "https://ftp.pcre.org/pub/pcre/pcre2-${PV}.tar.bz2 \ file://pcre-cross.patch \ + file://CVE-2017-7186.patch \ " SRC_URI[md5sum] = "8a096287153fb994970df3570e90fcb5"