From 4cd9ae41c5f7fd4de6d9a2970f8243c9555428a7 Mon Sep 17 00:00:00 2001 From: Robert Marko Date: Tue, 12 May 2020 22:18:33 +0200 Subject: libjson-c: backport security fixes This backports upstream fixes for the out of bounds write vulnerability in json-c. It was reported and patches in this upstream PR: https://github.com/json-c/json-c/pull/592 Addresses CVE-2020-12762 Signed-off-by: Robert Marko Signed-off-by: Luka Perkov [bump PKG_RELEASE, rebase patches on top of json-c 0.12] Signed-off-by: Jo-Philipp Wich (backported from commit bc0288b76816578f5aeccb2abd679f82bfc5738e) --- .../001-Prevent-division-by-zero-in-linkhash.patch | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 package/libs/libjson-c/patches/001-Prevent-division-by-zero-in-linkhash.patch (limited to 'package/libs/libjson-c/patches/001-Prevent-division-by-zero-in-linkhash.patch') diff --git a/package/libs/libjson-c/patches/001-Prevent-division-by-zero-in-linkhash.patch b/package/libs/libjson-c/patches/001-Prevent-division-by-zero-in-linkhash.patch new file mode 100644 index 0000000000..5345328d7c --- /dev/null +++ b/package/libs/libjson-c/patches/001-Prevent-division-by-zero-in-linkhash.patch @@ -0,0 +1,32 @@ +From 77d935b7ae7871a1940cd827e850e6063044ec45 Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Mon, 4 May 2020 19:46:45 +0200 +Subject: [PATCH 2/2] Prevent division by zero in linkhash. + +If a linkhash with a size of zero is created, then modulo operations +are prone to division by zero operations. + +Purely protective measure against bad usage. +--- + linkhash.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/linkhash.c ++++ b/linkhash.c +@@ -10,6 +10,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -431,6 +432,8 @@ struct lh_table* lh_table_new(int size, + int i; + struct lh_table *t; + ++ /* Allocate space for elements to avoid divisions by zero. */ ++ assert(size > 0); + t = (struct lh_table*)calloc(1, sizeof(struct lh_table)); + if(!t) lh_abort("lh_table_new: calloc failed\n"); + t->count = 0; -- cgit v1.2.3