[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
01/02: gnu: freeimage: Fix CVE-2016-5684.
From: |
Efraim Flashner |
Subject: |
01/02: gnu: freeimage: Fix CVE-2016-5684. |
Date: |
Fri, 14 Oct 2016 10:44:05 +0000 (UTC) |
efraim pushed a commit to branch master
in repository guix.
commit 76e8566c1b3c4876d649e712a5c8c473fd48d134
Author: Efraim Flashner <address@hidden>
Date: Fri Oct 14 11:28:21 2016 +0300
gnu: freeimage: Fix CVE-2016-5684.
* gnu/packages/image.scm (freeimage)[source]: Add patch.
* gnu/packages/patches/freeimage-CVE-2016-5684.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
---
gnu/local.mk | 1 +
gnu/packages/image.scm | 3 +-
gnu/packages/patches/freeimage-CVE-2016-5684.patch | 34 ++++++++++++++++++++
3 files changed, 37 insertions(+), 1 deletion(-)
diff --git a/gnu/local.mk b/gnu/local.mk
index 521ba2d..a9343f0 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -527,6 +527,7 @@ dist_patch_DATA =
\
%D%/packages/patches/fontconfig-CVE-2016-5384.patch \
%D%/packages/patches/fontforge-svg-modtime.patch \
%D%/packages/patches/freeimage-CVE-2015-0852.patch \
+ %D%/packages/patches/freeimage-CVE-2016-5684.patch \
%D%/packages/patches/gawk-fts-test.patch \
%D%/packages/patches/gawk-shell.patch \
%D%/packages/patches/gcc-arm-link-spec-fix.patch \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index b286089..27060d5 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -581,7 +581,8 @@ supplies a generic doubly-linked list and some string
functions.")
(sha256
(base32
"12bz57asdcfsz3zr9i9nska0fb6h3z2aizy412qjqkixkginbz7v"))
- (patches (search-patches "freeimage-CVE-2015-0852.patch"))))
+ (patches (search-patches "freeimage-CVE-2015-0852.patch"
+ "freeimage-CVE-2016-5684.patch"))))
(build-system gnu-build-system)
(arguments
'(#:phases (alist-delete
diff --git a/gnu/packages/patches/freeimage-CVE-2016-5684.patch
b/gnu/packages/patches/freeimage-CVE-2016-5684.patch
new file mode 100644
index 0000000..2fc02d7
--- /dev/null
+++ b/gnu/packages/patches/freeimage-CVE-2016-5684.patch
@@ -0,0 +1,34 @@
+From: Debian Science Maintainers
+ <address@hidden>
+Date: Mon, 10 Oct 2016 08:22:44 +0100
+Subject: CVE-2016-5684
+
+---
+ Source/FreeImage/PluginXPM.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/Source/FreeImage/PluginXPM.cpp b/Source/FreeImage/PluginXPM.cpp
+index a698321..cc7bd07 100644
+--- a/Source/FreeImage/PluginXPM.cpp
++++ b/Source/FreeImage/PluginXPM.cpp
+@@ -181,6 +181,11 @@ Load(FreeImageIO *io, fi_handle handle, int page, int
flags, void *data) {
+ }
+ free(str);
+
++ // check info string
++ if((width <= 0) || (height <= 0) || (colors <= 0) || (cpp <=
0)) {
++ throw "Improperly formed info string";
++ }
++
+ if (colors > 256) {
+ dib = FreeImage_AllocateHeader(header_only, width,
height, 24, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
+ } else {
+@@ -193,7 +198,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int
flags, void *data) {
+ FILE_RGBA rgba;
+
+ str = ReadString(io, handle);
+- if(!str)
++ if(!str || (strlen(str) < (size_t)cpp))
+ throw "Error reading color strings";
+
+ std::string chrs(str,cpp); //create a string for the
color chars using the first cpp chars