From 5dbebf3d35095e26463bbb0fddebf906454a685c Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Thu, 15 Oct 2020 19:02:53 +0200 Subject: [PATCH] package/oniguruma: fix CVE-2020-26159 Fix CVE-2020-26159: In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c. Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni --- .../0001-207-Out-of-bounds-write.patch | 25 +++++++++++++++++++ package/oniguruma/oniguruma.mk | 3 +++ 2 files changed, 28 insertions(+) create mode 100644 package/oniguruma/0001-207-Out-of-bounds-write.patch diff --git a/package/oniguruma/0001-207-Out-of-bounds-write.patch b/package/oniguruma/0001-207-Out-of-bounds-write.patch new file mode 100644 index 0000000000..3317449702 --- /dev/null +++ b/package/oniguruma/0001-207-Out-of-bounds-write.patch @@ -0,0 +1,25 @@ +From cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Mon, 21 Sep 2020 12:58:29 +0900 +Subject: [PATCH] #207: Out-of-bounds write + +[Retrieved from: +https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0] +Signed-off-by: Fabrice Fontaine +--- + src/regcomp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/regcomp.c b/src/regcomp.c +index f6494b6d..a0a68561 100644 +--- a/src/regcomp.c ++++ b/src/regcomp.c +@@ -6257,7 +6257,7 @@ concat_opt_exact_str(OptStr* to, UChar* s, UChar* end, OnigEncoding enc) + + for (i = to->len, p = s; p < end && i < OPT_EXACT_MAXLEN; ) { + len = enclen(enc, p); +- if (i + len > OPT_EXACT_MAXLEN) break; ++ if (i + len >= OPT_EXACT_MAXLEN) break; + for (j = 0; j < len && p < end; j++) + to->s[i++] = *p++; + } diff --git a/package/oniguruma/oniguruma.mk b/package/oniguruma/oniguruma.mk index d1ff1f115f..c2330c7380 100644 --- a/package/oniguruma/oniguruma.mk +++ b/package/oniguruma/oniguruma.mk @@ -12,4 +12,7 @@ ONIGURUMA_LICENSE = BSD-2-Clause ONIGURUMA_LICENSE_FILES = COPYING ONIGURUMA_INSTALL_STAGING = YES +# 0001-207-Out-of-bounds-write.patch +ONIGURUMA_IGNORE_CVES += CVE-2020-26159 + $(eval $(autotools-package)) -- 2.30.2