From 1c7d6584a7811b7785ae5c1e378f14b5ba0971cf Mon Sep 17 00:00:00 2001 From: takeshi_hoshina Date: Mon, 2 Nov 2020 11:07:33 +0900 Subject: basesystem-jj recipes --- .../qemu/qemu/CVE-2018-17963.patch | 51 ---------------------- 1 file changed, 51 deletions(-) delete mode 100644 external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-17963.patch (limited to 'external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-17963.patch') diff --git a/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-17963.patch b/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-17963.patch deleted file mode 100644 index 054cdc86..00000000 --- a/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-17963.patch +++ /dev/null @@ -1,51 +0,0 @@ -From e5ff72a8005dd1d9c0f63f8a9cc4298df5bb7551 Mon Sep 17 00:00:00 2001 -From: Changqing Li -Date: Mon, 15 Oct 2018 16:39:46 +0800 -Subject: [PATCH] pcnet: fix possible buffer overflow - -In pcnet_receive(), we try to assign size_ to size which converts from -size_t to integer. This will cause troubles when size_ is greater -INT_MAX, this will lead a negative value in size and it can then pass -the check of size < MIN_BUF_SIZE which may lead out of bound access -for both buf and buf1. - -Fixing by converting the type of size to size_t. - -CC: address@hidden -Reported-by: Daniel Shapira -Reviewed-by: Michael S. Tsirkin -Signed-off-by: Jason Wang - -Upstream-Status: Backport [https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03268.html] - -CVE: CVE-2018-17963 - -Signed-off-by: Changqing Li ---- - hw/net/pcnet.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c -index 0c44554..d9ba04b 100644 ---- a/hw/net/pcnet.c -+++ b/hw/net/pcnet.c -@@ -988,14 +988,14 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) - uint8_t buf1[60]; - int remaining; - int crc_err = 0; -- int size = size_; -+ size_t size = size_; - - if (CSR_DRX(s) || CSR_STOP(s) || CSR_SPND(s) || !size || - (CSR_LOOP(s) && !s->looptest)) { - return -1; - } - #ifdef PCNET_DEBUG -- printf("pcnet_receive size=%d\n", size); -+ printf("pcnet_receive size=%zu\n", size); - #endif - - /* if too small buffer, then expand it */ --- -2.7.4 - -- cgit 1.2.3-korg