diff options
author | Dan Andresan <Dan.Andresan@enea.com> | 2018-10-29 12:00:01 +0100 |
---|---|---|
committer | Gerrit Code Review <gerrit2@sestogerrit02> | 2018-10-29 12:00:01 +0100 |
commit | 6dfe6d721a12a0527364d810020f8ac5ae486e2f (patch) | |
tree | d5c3ea63190f021d2a8dab037d23f1e1831026b2 /recipes-support/libcroco/libcroco | |
parent | 4687669cd351da188c0c23ddecaaf925f6ac44b9 (diff) | |
parent | ca46203a1fdcf2a83b1a4f41a8b5ef9eb2b787e6 (diff) | |
download | meta-el-common-6dfe6d721a12a0527364d810020f8ac5ae486e2f.tar.gz |
Merge "libcroco: Fix CVE-2017-7961" into pyro
Diffstat (limited to 'recipes-support/libcroco/libcroco')
-rw-r--r-- | recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch b/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch new file mode 100644 index 0000000..520a52d --- /dev/null +++ b/recipes-support/libcroco/libcroco/CVE-2017-7961-tknzr-support-only-max-long-rgb-values.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Ignacio Casal Quinteiro <qignacio@amazon.com> | ||
3 | Date: Sun, 16 Apr 2017 13:56:09 +0200 | ||
4 | Subject: [PATCH] tknzr: support only max long rgb values | ||
5 | |||
6 | This fixes a possible out of bound when reading rgbs which | ||
7 | are longer than the support MAXLONG | ||
8 | |||
9 | CVE: CVE-2017-7961 | ||
10 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libcroco/commit/9ad72875e9f08e4c519ef63d44cdbd94aa9504f7] | ||
11 | |||
12 | Signed-off-by: Andreas Wellving <andreas.wellving@enea.com> | ||
13 | --- | ||
14 | src/cr-tknzr.c | 10 ++++++++++ | ||
15 | 1 file changed, 10 insertions(+) | ||
16 | |||
17 | diff --git a/src/cr-tknzr.c b/src/cr-tknzr.c | ||
18 | index 1a7cfeb..1548c35 100644 | ||
19 | --- a/src/cr-tknzr.c | ||
20 | +++ b/src/cr-tknzr.c | ||
21 | @@ -1279,6 +1279,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb) | ||
22 | status = cr_tknzr_parse_num (a_this, &num); | ||
23 | ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL)); | ||
24 | |||
25 | + if (num->val > G_MAXLONG) { | ||
26 | + status = CR_PARSING_ERROR; | ||
27 | + goto error; | ||
28 | + } | ||
29 | + | ||
30 | red = num->val; | ||
31 | cr_num_destroy (num); | ||
32 | num = NULL; | ||
33 | @@ -1298,6 +1303,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb) | ||
34 | status = cr_tknzr_parse_num (a_this, &num); | ||
35 | ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL)); | ||
36 | |||
37 | + if (num->val > G_MAXLONG) { | ||
38 | + status = CR_PARSING_ERROR; | ||
39 | + goto error; | ||
40 | + } | ||
41 | + | ||
42 | PEEK_BYTE (a_this, 1, &next_bytes[0]); | ||
43 | if (next_bytes[0] == '%') { | ||
44 | SKIP_CHARS (a_this, 1); | ||
45 | -- | ||
46 | 2.7.4 | ||
47 | |||