]> code.ossystems Code Review - openembedded-core.git/commit
libpcre2: Fix CVE-2017-7186
authorRobert Yang <liezhi.yang@windriver.com>
Wed, 30 Aug 2017 00:48:57 +0000 (17:48 -0700)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Wed, 30 Aug 2017 10:19:35 +0000 (11:19 +0100)
commit1b87201784e733f3a9d436f56cb5a6151ba6bdfa
tree1024d043ef71f54eb436265efbb72072d3f8d576
parentdd63a26fedb8a578d34850ede4c27e26b8876e7e
libpcre2: Fix CVE-2017-7186

A fuzz on libpcre1 through the pcretest utility revealed an invalid read in the
library. For who is interested in a detailed description of the bug, will
follow a feedback from upstream:

This was a genuine bug in the 32-bit library. Thanks for finding it. The crash
was caused by trying to find a Unicode property for a code value greater than
0x10ffff, the Unicode maximum, when running in non-UTF mode (where character
values can be up to 0xffffffff).

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/recipes-support/libpcre/libpcre2/libpcre2-CVE-2017-7186.patch [new file with mode: 0644]
meta/recipes-support/libpcre/libpcre2_10.23.bb