diff options
author | Christopher Baines <mail@cbaines.net> | 2021-03-05 22:56:40 +0000 |
---|---|---|
committer | Christopher Baines <mail@cbaines.net> | 2021-03-06 00:18:30 +0000 |
commit | a8448da0f4a090818104e64dd79f90b0e50d5e77 (patch) | |
tree | 494c58b4724f12cd9de0db9b0a7096de2b922c0f /gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch | |
parent | 4f4b749e75b38b8c08b4f67ef51c2c8740999e28 (diff) | |
parent | a714af38d5d1046081524d859cde4cd8fd12a923 (diff) | |
download | guix-patches-a8448da0f4a090818104e64dd79f90b0e50d5e77.tar guix-patches-a8448da0f4a090818104e64dd79f90b0e50d5e77.tar.gz |
Merge branch 'master' into core-updates
Diffstat (limited to 'gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch')
-rw-r--r-- | gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch | 66 |
1 files changed, 0 insertions, 66 deletions
diff --git a/gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch b/gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch deleted file mode 100644 index 69e65aeb6b..0000000000 --- a/gnu/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch +++ /dev/null @@ -1,66 +0,0 @@ -Fix CVE-2017-14859, CVE-2017-14862 and CVE-2017-14864. - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14859 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14862 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14864 - -Copied from upstream: - -https://github.com/Exiv2/exiv2/commit/8a586c74bbe3fbca64e86e42a42282c73f427607 - -From 8a586c74bbe3fbca64e86e42a42282c73f427607 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Dan=20=C4=8Cerm=C3=A1k?= <dan.cermak@cgc-instruments.com> -Date: Sat, 7 Oct 2017 23:08:36 +0200 -Subject: [PATCH] Fix for CVE-2017-14864, CVE-2017-14862 and CVE-2017-14859 - -The invalid memory dereference in -Exiv2::getULong()/Exiv2::StringValueBase::read()/Exiv2::DataValue::read() -is caused further up the call-stack, by -v->read(pData, size, byteOrder) in TiffReader::readTiffEntry() -passing an invalid pData pointer (pData points outside of the Tiff -file). pData can be set out of bounds in the (size > 4) branch where -baseOffset() and offset are added to pData_ without checking whether -the result is still in the file. As offset comes from an untrusted -source, an attacker can craft an arbitrarily large offset into the -file. - -This commit adds a check into the problematic branch, whether the -result of the addition would be out of bounds of the Tiff -file. Furthermore the whole operation is checked for possible -overflows. ---- - src/tiffvisitor.cpp | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/src/tiffvisitor.cpp b/src/tiffvisitor.cpp -index 4ab733d4..ef13542e 100644 ---- a/src/tiffvisitor.cpp -+++ b/src/tiffvisitor.cpp -@@ -47,6 +47,7 @@ EXIV2_RCSID("@(#) $Id$") - #include <iostream> - #include <iomanip> - #include <cassert> -+#include <limits> - - // ***************************************************************************** - namespace { -@@ -1517,7 +1518,19 @@ namespace Exiv2 { - size = 0; - } - if (size > 4) { -+ // setting pData to pData_ + baseOffset() + offset can result in pData pointing to invalid memory, -+ // as offset can be arbitrarily large -+ if ((static_cast<uintptr_t>(baseOffset()) > std::numeric_limits<uintptr_t>::max() - static_cast<uintptr_t>(offset)) -+ || (static_cast<uintptr_t>(baseOffset() + offset) > std::numeric_limits<uintptr_t>::max() - reinterpret_cast<uintptr_t>(pData_))) -+ { -+ throw Error(59); -+ } -+ if (pData_ + static_cast<uintptr_t>(baseOffset()) + static_cast<uintptr_t>(offset) > pLast_) { -+ throw Error(58); -+ } - pData = const_cast<byte*>(pData_) + baseOffset() + offset; -+ -+ // check for size being invalid - if (size > static_cast<uint32_t>(pLast_ - pData)) { - #ifndef SUPPRESS_WARNINGS - EXV_ERROR << "Upper boundary of data for " |