diff options
author | Andrew Geissler <geissonator@yahoo.com> | 2020-12-12 01:27:59 +0300 |
---|---|---|
committer | Andrew Geissler <geissonator@yahoo.com> | 2020-12-12 01:28:21 +0300 |
commit | 8fc454f9beebdd347403145c991697019a593cff (patch) | |
tree | 8cf3da68cb51c21d0989a7fb81249229e70b6fc8 /meta-openembedded/meta-oe/recipes-extended/dlt-daemon | |
parent | 12e5ffbbbaa05790d387750fadff4a2bf74e4f93 (diff) | |
download | openbmc-8fc454f9beebdd347403145c991697019a593cff.tar.xz |
meta-openembedded: subtree update:f623d8b574..936f2380bb
Alexander Vickberg (2):
libwebsockets: upgrade to 4.1.6
mbedtls: upgrade to 2.24.0
Bartosz Golaszewski (1):
libgpiod: update v1.4.5 -> v1.6.2
Beniamin Sandu (1):
trace-cmd: create recipe for version 2.9.1
Fabio Berton (2):
beep: Add recipe for version 1.2.2
linuxconsole: Add recipe for version 1.7.0
Gianfranco (1):
dlt-daemon: add upstream patch to fix CVE-2020-29394
Kai Kang (1):
colord: fix installed-vs-shipped error
Khem Raj (1):
packagegroup-meta-python: Remove packages moved to core
Luca Boccassi (3):
dbus-broker: rdepend on dbus-common
dbus-brocker: upgrade 23 -> 24
dbus-broker: upgrade 24 -> 25
Martin Jansa (1):
nanopb: move to dynamic-layers
Michael Vetter (1):
jasper: upgrade 2.0.22 -> 2.0.23
Philip Balister (1):
spdlog: Fix recipe so other recipes can use spdlog with external fmt.
Robert Karszniewicz (1):
firmwared: add recipe
Roland Hieber (5):
pcsc-lite: provide pcsc-lite-lib-native explicitly for native build
lockfile-progs: use DEBIAN_MIRROR in SRC_URI
fbset: use DEBIAN_MIRROR in SRC_URI
liboop: use upstream SRC_URI
openct: use upstream SRC_URI
Senthil Selvaganesan (1):
fcgiwrap: add recipe
Thomas Perrot (1):
openocd: disable the support of ccache
Trevor Woerner (4):
glmark2: update information
glmark2: update to latest
glmark2: add support for dispmanx
glmark2: revert to previous behaviour
Vyacheslav Yurkov (1):
python3-aiohttp: added missing RDEPENDs
Wang Mingyu (2):
gensio: 2.1.4 -> 2.2.0
ser2net: 4.2.0 -> 4.3.0
Zang Ruochen (7):
dialog: upgrade 1.3-20200327 -> 1.3-20201126
fmt: upgrade 7.1.2 -> 7.1.3
hidapi: upgrade 0.10.0 -> 0.10.1
opensc: upgrade 0.20.0 -> 0.20.1
pugixml: upgrade 1.10 -> 1.11
satyr: upgrade 0.31 -> 0.35
nanopb: upgrade 0.4.3 -> 0.4.4
zhengruoqin (9):
c-periphery: upgrade 2.2.4 -> 2.2.5
crash: upgrade 7.2.8 -> 7.2.9
dfu-util: upgrade 0.9 -> 0.10
monit: upgrade 5.26.0 -> 5.27.1
qpdf: upgrade 10.0.1 -> 10.0.4
tcsh: upgrade 6.22.02 -> 6.22.03
xserver-xorg-cvt-native: upgrade 1.20.5 -> 1.20.9
zchunk: upgrade 1.1.6 -> 1.1.7
libconfig-autoconf-perl: upgrade 0.318 -> 0.319
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I8371eb789fa288193da895bd51ce2160194809d8
Diffstat (limited to 'meta-openembedded/meta-oe/recipes-extended/dlt-daemon')
-rw-r--r-- | meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon/275.patch | 38 | ||||
-rw-r--r-- | meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon_2.18.5.bb | 1 |
2 files changed, 39 insertions, 0 deletions
diff --git a/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon/275.patch b/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon/275.patch new file mode 100644 index 000000000..75065eb05 --- /dev/null +++ b/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon/275.patch @@ -0,0 +1,38 @@ +Upstream-status: Backport +CVE: CVE-2020-29394 +From 7f5cd5404a03fa330e192084f6bdafb2dc9bdcb7 Mon Sep 17 00:00:00 2001 +From: GwanYeong Kim <gy741.kim@gmail.com> +Date: Sat, 28 Nov 2020 12:24:46 +0900 +Subject: [PATCH] dlt_common: Fix buffer overflow in dlt_filter_load + +A buffer overflow in the dlt_filter_load function in dlt_common.c in dlt-daemon allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument. + +Fixed: #274 + +Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com> +--- + src/shared/dlt_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/shared/dlt_common.c b/src/shared/dlt_common.c +index 254f4ce4..d15b1cec 100644 +--- a/src/shared/dlt_common.c ++++ b/src/shared/dlt_common.c +@@ -404,7 +404,7 @@ DltReturnValue dlt_filter_load(DltFilter *filter, const char *filename, int verb + while (!feof(handle)) { + str1[0] = 0; + +- if (fscanf(handle, "%s", str1) != 1) ++ if (fscanf(handle, "%254s", str1) != 1) + break; + + if (str1[0] == 0) +@@ -419,7 +419,7 @@ DltReturnValue dlt_filter_load(DltFilter *filter, const char *filename, int verb + + str1[0] = 0; + +- if (fscanf(handle, "%s", str1) != 1) ++ if (fscanf(handle, "%254s", str1) != 1) + break; + + if (str1[0] == 0) diff --git a/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon_2.18.5.bb b/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon_2.18.5.bb index f3fcee4d2..5066e76d3 100644 --- a/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon_2.18.5.bb +++ b/meta-openembedded/meta-oe/recipes-extended/dlt-daemon/dlt-daemon_2.18.5.bb @@ -19,6 +19,7 @@ SRC_URI = "git://github.com/GENIVI/${BPN}.git;protocol=https \ file://0004-Modify-systemd-config-directory.patch \ file://241.patch \ file://245.patch \ + file://275.patch \ " SRCREV = "f1ac087c766827b1d0ed9c3a814b3cc052e948f2" |