diff options
author | Sakib Sajal <sakib.sajal@windriver.com> | 2021-08-25 19:00:51 -0400 |
---|---|---|
committer | Khem Raj <raj.khem@gmail.com> | 2021-08-26 10:10:56 -0700 |
commit | 59d6f63abbc5115de147f22fa0496d39533c020d (patch) | |
tree | 996dd2032acf5d04837e624b35370beedc0951d0 | |
parent | 1c9188c942fe222b6a360e6e843aee2d6d156940 (diff) | |
download | meta-openembedded-59d6f63abbc5115de147f22fa0496d39533c020d.tar.gz |
gd: fix CVE-2021-38115
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
-rw-r--r-- | meta-oe/recipes-support/gd/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch | 29 | ||||
-rw-r--r-- | meta-oe/recipes-support/gd/gd_2.3.2.bb | 1 |
2 files changed, 30 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/gd/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch b/meta-oe/recipes-support/gd/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch new file mode 100644 index 000000000..6152a1184 --- /dev/null +++ b/meta-oe/recipes-support/gd/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | From 8b111b2b4a4842179be66db68d84dda91a246032 Mon Sep 17 00:00:00 2001 | ||
2 | From: maryam ebrahimzadeh <maryam.ebr@student.sharif.edu> | ||
3 | Date: Mon, 19 Jul 2021 10:07:13 +0430 | ||
4 | Subject: [PATCH] fix read out-of-bands in reading tga header file | ||
5 | |||
6 | --- | ||
7 | src/gd_tga.c | 6 +++++- | ||
8 | 1 file changed, 5 insertions(+), 1 deletion(-) | ||
9 | |||
10 | diff --git a/src/gd_tga.c b/src/gd_tga.c | ||
11 | index cae9428..286febb 100644 | ||
12 | --- a/src/gd_tga.c | ||
13 | +++ b/src/gd_tga.c | ||
14 | @@ -191,7 +191,11 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga) | ||
15 | return -1; | ||
16 | } | ||
17 | |||
18 | - gdGetBuf(tga->ident, tga->identsize, ctx); | ||
19 | + | ||
20 | + if (gdGetBuf(tga->ident, tga->identsize, ctx) != tga->identsize) { | ||
21 | + gd_error("fail to read header ident"); | ||
22 | + return -1; | ||
23 | + } | ||
24 | } | ||
25 | |||
26 | return 1; | ||
27 | -- | ||
28 | 2.25.1 | ||
29 | |||
diff --git a/meta-oe/recipes-support/gd/gd_2.3.2.bb b/meta-oe/recipes-support/gd/gd_2.3.2.bb index c9ed029f9..32484ce79 100644 --- a/meta-oe/recipes-support/gd/gd_2.3.2.bb +++ b/meta-oe/recipes-support/gd/gd_2.3.2.bb | |||
@@ -15,6 +15,7 @@ DEPENDS = "freetype libpng jpeg zlib tiff" | |||
15 | 15 | ||
16 | SRC_URI = "git://github.com/libgd/libgd.git;branch=master \ | 16 | SRC_URI = "git://github.com/libgd/libgd.git;branch=master \ |
17 | file://0001-replace-uint32-with-uint32_t-and-uint16-with-uint16_.patch \ | 17 | file://0001-replace-uint32-with-uint32_t-and-uint16-with-uint16_.patch \ |
18 | file://0001-fix-read-out-of-bands-in-reading-tga-header-file.patch \ | ||
18 | " | 19 | " |
19 | 20 | ||
20 | SRCREV = "2e40f55bfb460fc9d8cbcd290a0c9eb908d5af7e" | 21 | SRCREV = "2e40f55bfb460fc9d8cbcd290a0c9eb908d5af7e" |