* [PATCH][dizzy] icu: CVE-2014-8146-CVE-2014-8147
@ 2015-09-04 10:51 Sona Sarmadi
2015-09-04 23:47 ` akuster808
0 siblings, 1 reply; 2+ messages in thread
From: Sona Sarmadi @ 2015-09-04 10:51 UTC (permalink / raw)
To: openembedded-core
CVE-2014-8146 icu: heap overflow via incorrect isolateCount
CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function
References:
[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
[2] https://www.kb.cert.org/vuls/id/602540
[3] http://bugs.icu-project.org/trac/changeset/37080
[4] http://bugs.icu-project.org/trac/changeset/37162
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
.../icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch | 49 ++++++++++++++++++++++
meta/recipes-support/icu/icu_53.1.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
diff --git a/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
new file mode 100644
index 0000000..2460357
--- /dev/null
+++ b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
@@ -0,0 +1,49 @@
+icu: CVE-2014-8146-CVE-2014-8147
+
+CVE-2014-8146 icu: heap overflow via incorrect isolateCount
+CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function
+
+References:
+[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
+[2] https://www.kb.cert.org/vuls/id/602540
+[3] http://bugs.icu-project.org/trac/changeset/37080
+[4] http://bugs.icu-project.org/trac/changeset/37162
+
+Upstream-Status: Backport
+
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+diff -ruN a/common/ubidi.c b/common/ubidi.c
+--- a/common/ubidi.c 2014-10-03 18:11:20.000000000 +0200
++++ b/common/ubidi.c 2015-08-28 08:22:39.455906194 +0200
+@@ -2138,7 +2138,7 @@
+ /* The isolates[] entries contain enough information to
+ resume the bidi algorithm in the same state as it was
+ when it was interrupted by an isolate sequence. */
+- if(dirProps[start]==PDI) {
++ if(dirProps[start]==PDI && pBiDi->isolateCount >= 0) {
+ levState.startON=pBiDi->isolates[pBiDi->isolateCount].startON;
+ start1=pBiDi->isolates[pBiDi->isolateCount].start1;
+ stateImp=pBiDi->isolates[pBiDi->isolateCount].stateImp;
+diff -ruN a/common/ubidiimp.h b/common/ubidiimp.h
+--- a/common/ubidiimp.h 2014-10-03 18:11:16.000000000 +0200
++++ b/common/ubidiimp.h 2015-08-28 08:28:24.069163845 +0200
+@@ -1,7 +1,7 @@
+ /*
+ ******************************************************************************
+ *
+-* Copyright (C) 1999-2014, International Business Machines
++* Copyright (C) 1999-2015, International Business Machines
+ * Corporation and others. All Rights Reserved.
+ *
+ ******************************************************************************
+@@ -184,8 +184,8 @@
+ typedef struct Isolate {
+ int32_t startON;
+ int32_t start1;
++ int32_t state;
+ int16_t stateImp;
+- int16_t state;
+ } Isolate;
+
+ typedef struct Run {
diff --git a/meta/recipes-support/icu/icu_53.1.bb b/meta/recipes-support/icu/icu_53.1.bb
index d93af68..2906e8f 100644
--- a/meta/recipes-support/icu/icu_53.1.bb
+++ b/meta/recipes-support/icu/icu_53.1.bb
@@ -11,6 +11,7 @@ ICU_PV = "${@icu_download_version(d)}"
BASE_SRC_URI = "http://download.icu-project.org/files/icu4c/${PV}/icu4c-${ICU_PV}-src.tgz"
SRC_URI = "${BASE_SRC_URI} \
file://icu-pkgdata-large-cmd.patch \
+ file://icu-CVE-2014-8146-CVE-2014-8147.patch \
"
SRC_URI_append_class-target = "\
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH][dizzy] icu: CVE-2014-8146-CVE-2014-8147
2015-09-04 10:51 [PATCH][dizzy] icu: CVE-2014-8146-CVE-2014-8147 Sona Sarmadi
@ 2015-09-04 23:47 ` akuster808
0 siblings, 0 replies; 2+ messages in thread
From: akuster808 @ 2015-09-04 23:47 UTC (permalink / raw)
To: openembedded-core
queuing up,
thanks,
Armin
On 09/04/2015 03:51 AM, Sona Sarmadi wrote:
> CVE-2014-8146 icu: heap overflow via incorrect isolateCount
> CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function
>
> References:
> [1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
> [2] https://www.kb.cert.org/vuls/id/602540
> [3] http://bugs.icu-project.org/trac/changeset/37080
> [4] http://bugs.icu-project.org/trac/changeset/37162
>
> Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
> ---
> .../icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch | 49 ++++++++++++++++++++++
> meta/recipes-support/icu/icu_53.1.bb | 1 +
> 2 files changed, 50 insertions(+)
> create mode 100644 meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
>
> diff --git a/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
> new file mode 100644
> index 0000000..2460357
> --- /dev/null
> +++ b/meta/recipes-support/icu/icu/icu-CVE-2014-8146-CVE-2014-8147.patch
> @@ -0,0 +1,49 @@
> +icu: CVE-2014-8146-CVE-2014-8147
> +
> +CVE-2014-8146 icu: heap overflow via incorrect isolateCount
> +CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function
> +
> +References:
> +[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
> +[2] https://www.kb.cert.org/vuls/id/602540
> +[3] http://bugs.icu-project.org/trac/changeset/37080
> +[4] http://bugs.icu-project.org/trac/changeset/37162
> +
> +Upstream-Status: Backport
> +
> +Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
> +---
> +diff -ruN a/common/ubidi.c b/common/ubidi.c
> +--- a/common/ubidi.c 2014-10-03 18:11:20.000000000 +0200
> ++++ b/common/ubidi.c 2015-08-28 08:22:39.455906194 +0200
> +@@ -2138,7 +2138,7 @@
> + /* The isolates[] entries contain enough information to
> + resume the bidi algorithm in the same state as it was
> + when it was interrupted by an isolate sequence. */
> +- if(dirProps[start]==PDI) {
> ++ if(dirProps[start]==PDI && pBiDi->isolateCount >= 0) {
> + levState.startON=pBiDi->isolates[pBiDi->isolateCount].startON;
> + start1=pBiDi->isolates[pBiDi->isolateCount].start1;
> + stateImp=pBiDi->isolates[pBiDi->isolateCount].stateImp;
> +diff -ruN a/common/ubidiimp.h b/common/ubidiimp.h
> +--- a/common/ubidiimp.h 2014-10-03 18:11:16.000000000 +0200
> ++++ b/common/ubidiimp.h 2015-08-28 08:28:24.069163845 +0200
> +@@ -1,7 +1,7 @@
> + /*
> + ******************************************************************************
> + *
> +-* Copyright (C) 1999-2014, International Business Machines
> ++* Copyright (C) 1999-2015, International Business Machines
> + * Corporation and others. All Rights Reserved.
> + *
> + ******************************************************************************
> +@@ -184,8 +184,8 @@
> + typedef struct Isolate {
> + int32_t startON;
> + int32_t start1;
> ++ int32_t state;
> + int16_t stateImp;
> +- int16_t state;
> + } Isolate;
> +
> + typedef struct Run {
> diff --git a/meta/recipes-support/icu/icu_53.1.bb b/meta/recipes-support/icu/icu_53.1.bb
> index d93af68..2906e8f 100644
> --- a/meta/recipes-support/icu/icu_53.1.bb
> +++ b/meta/recipes-support/icu/icu_53.1.bb
> @@ -11,6 +11,7 @@ ICU_PV = "${@icu_download_version(d)}"
> BASE_SRC_URI = "http://download.icu-project.org/files/icu4c/${PV}/icu4c-${ICU_PV}-src.tgz"
> SRC_URI = "${BASE_SRC_URI} \
> file://icu-pkgdata-large-cmd.patch \
> + file://icu-CVE-2014-8146-CVE-2014-8147.patch \
> "
>
> SRC_URI_append_class-target = "\
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-09-04 23:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-09-04 10:51 [PATCH][dizzy] icu: CVE-2014-8146-CVE-2014-8147 Sona Sarmadi
2015-09-04 23:47 ` akuster808
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox