poky/meta/recipes-devtools/file/file/CVE-2019-8906.patch

From 2858eaf99f6cc5aae129bcbf1e24ad160240185f Mon Sep 17 00:00:00 2001
From: Christos Zoulas <christos@zoulas.com>
Date: Wed, 2 Jan 2019 19:44:14 +0000
Subject: [PATCH] Avoid OOB read (found by ASAN reported by F. Alonso)

Upstream-Status: Backport
CVE: CVE-2019-8906
Affects < 5.36
[Fixup for thud context]
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
 src/readelf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: git/src/readelf.c
===================================================================
--- git.orig/src/readelf.c
+++ git/src/readelf.c
@@ -745,7 +745,7 @@ do_core_note(struct magic_set *ms, unsig
 			char sbuf[512];
 			struct NetBSD_elfcore_procinfo pi;
 			memset(&pi, 0, sizeof(pi));
-			memcpy(&pi, nbuf + doff, descsz);
+			memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
 
 			if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
 			    "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",