diff options
author | Efraim Flashner <efraim@flashner.co.il> | 2021-03-24 15:28:33 +0200 |
---|---|---|
committer | Efraim Flashner <efraim@flashner.co.il> | 2021-03-24 20:50:44 +0200 |
commit | 2aab587f842908a886e3bd08b028885dddd650e0 (patch) | |
tree | 87c0723a9ae2c69ab6920d90b6e87ad8510492fe /gnu/packages/patches/ytnef-CVE-2021-3403.patch | |
parent | 5664bcdcb0e4c10dfe48dd5e4730fc3c746a21e2 (diff) | |
parent | 65c46e79e0495fe4d32f6f2725d7233fff10fd70 (diff) | |
download | guix-patches-2aab587f842908a886e3bd08b028885dddd650e0.tar guix-patches-2aab587f842908a886e3bd08b028885dddd650e0.tar.gz |
Merge remote-tracking branch 'origin/master' into core-updates
Diffstat (limited to 'gnu/packages/patches/ytnef-CVE-2021-3403.patch')
-rw-r--r-- | gnu/packages/patches/ytnef-CVE-2021-3403.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/gnu/packages/patches/ytnef-CVE-2021-3403.patch b/gnu/packages/patches/ytnef-CVE-2021-3403.patch new file mode 100644 index 0000000000..4b1c9d659f --- /dev/null +++ b/gnu/packages/patches/ytnef-CVE-2021-3403.patch @@ -0,0 +1,32 @@ +From f2380a53fb84d370eaf6e6c3473062c54c57fac7 Mon Sep 17 00:00:00 2001 +From: Oliver Giles <ohw.giles@gmail.com> +Date: Mon, 1 Feb 2021 10:12:16 +1300 +Subject: [PATCH] Prevent potential double-free in TNEFSubjectHandler + +If TNEFSubjectHandler is called multiple times, but the last time +failed due to the PREALLOCCHECK, the subject.data member will be +a freed, but invalid pointer. To prevent a double-free next time +TNEFSubjectHandler is entered, set it to zero after freeing. + +Resolves: #85 +Reported-by: jasperla +--- + lib/ytnef.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/ytnef.c b/lib/ytnef.c +index b148719..b06c807 100644 +--- a/lib/ytnef.c ++++ b/lib/ytnef.c +@@ -301,8 +301,10 @@ int TNEFFromHandler STD_ARGLIST { + } + // ----------------------------------------------------------------------------- + int TNEFSubjectHandler STD_ARGLIST { +- if (TNEF->subject.data) ++ if (TNEF->subject.data) { + free(TNEF->subject.data); ++ TNEF->subject.data = NULL; ++ } + + PREALLOCCHECK(size, 100); + TNEF->subject.data = calloc(size+1, sizeof(BYTE)); |