diff options
author | Hitendra Prajapati <hprajapati@mvista.com> | 2022-08-09 09:40:00 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-08-31 16:54:17 +0100 |
commit | 992a4cfd10e70d388bf8329f17624376b6120b17 (patch) | |
tree | e5df4873ceb636fe61510922c7885f2a12be5035 /meta/recipes-gnome | |
parent | bc3ef76f40be5898a4fa41d4a38b8adb29db2616 (diff) | |
download | poky-992a4cfd10e70d388bf8329f17624376b6120b17.tar.gz |
Revert "gdk-pixbuf: CVE-2021-46829 a heap-based buffer overflow"
CVE will be fixed in subsequent stable release update
This reverts commit 978bc910ac326e34ec4f99c4645a80ed09c65407.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-gnome')
-rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2021-46829.patch | 61 | ||||
-rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.6.bb | 1 |
2 files changed, 0 insertions, 62 deletions
diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2021-46829.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2021-46829.patch deleted file mode 100644 index 82ceae6348..0000000000 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2021-46829.patch +++ /dev/null | |||
@@ -1,61 +0,0 @@ | |||
1 | From dc296a24862c2bcfbfbd642abbb4826ec282f0a1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Hitendra Prajapati <hprajapati@mvista.com> | ||
3 | Date: Mon, 8 Aug 2022 17:28:21 +0530 | ||
4 | Subject: [PATCH] CVE-2021-46829 | ||
5 | |||
6 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/5398f04d772f7f8baf5265715696ed88db0f0512] | ||
7 | CVE: CVE-2021-46829 | ||
8 | Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> | ||
9 | --- | ||
10 | gdk-pixbuf/io-gif-animation.c | 21 +++++++++++++-------- | ||
11 | 1 file changed, 13 insertions(+), 8 deletions(-) | ||
12 | |||
13 | diff --git a/gdk-pixbuf/io-gif-animation.c b/gdk-pixbuf/io-gif-animation.c | ||
14 | index 8335cdd..71d9265 100644 | ||
15 | --- a/gdk-pixbuf/io-gif-animation.c | ||
16 | +++ b/gdk-pixbuf/io-gif-animation.c | ||
17 | @@ -369,7 +369,7 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame) | ||
18 | for (i = 0; i < n_indexes; i++) { | ||
19 | guint8 index = index_buffer[i]; | ||
20 | guint x, y; | ||
21 | - int offset; | ||
22 | + gsize offset; | ||
23 | |||
24 | if (index == frame->transparent_index) | ||
25 | continue; | ||
26 | @@ -379,11 +379,13 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame) | ||
27 | if (x >= anim->width || y >= anim->height) | ||
28 | continue; | ||
29 | |||
30 | - offset = y * gdk_pixbuf_get_rowstride (anim->last_frame_data) + x * 4; | ||
31 | - pixels[offset + 0] = frame->color_map[index * 3 + 0]; | ||
32 | - pixels[offset + 1] = frame->color_map[index * 3 + 1]; | ||
33 | - pixels[offset + 2] = frame->color_map[index * 3 + 2]; | ||
34 | - pixels[offset + 3] = 255; | ||
35 | + if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride (anim->last_frame_data), y) && | ||
36 | + g_size_checked_add (&offset, offset, x * 4)) { | ||
37 | + pixels[offset + 0] = frame->color_map[index * 3 + 0]; | ||
38 | + pixels[offset + 1] = frame->color_map[index * 3 + 1]; | ||
39 | + pixels[offset + 2] = frame->color_map[index * 3 + 2]; | ||
40 | + pixels[offset + 3] = 255; | ||
41 | + } | ||
42 | } | ||
43 | |||
44 | out: | ||
45 | @@ -448,8 +450,11 @@ gdk_pixbuf_gif_anim_iter_get_pixbuf (GdkPixbufAnimationIter *anim_iter) | ||
46 | x_end = MIN (anim->last_frame->x_offset + anim->last_frame->width, anim->width); | ||
47 | y_end = MIN (anim->last_frame->y_offset + anim->last_frame->height, anim->height); | ||
48 | for (y = anim->last_frame->y_offset; y < y_end; y++) { | ||
49 | - guchar *line = pixels + y * gdk_pixbuf_get_rowstride (anim->last_frame_data) + anim->last_frame->x_offset * 4; | ||
50 | - memset (line, 0, (x_end - anim->last_frame->x_offset) * 4); | ||
51 | + gsize offset; | ||
52 | + if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride (anim->last_frame_data), y) && | ||
53 | + g_size_checked_add (&offset, offset, anim->last_frame->x_offset * 4)) { | ||
54 | + memset (pixels + offset, 0, (x_end - anim->last_frame->x_offset) * 4); | ||
55 | + } | ||
56 | } | ||
57 | break; | ||
58 | case GDK_PIXBUF_FRAME_REVERT: | ||
59 | -- | ||
60 | 2.25.1 | ||
61 | |||
diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.6.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.6.bb index b5ff29b5e3..55c16e4d66 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.6.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.6.bb | |||
@@ -21,7 +21,6 @@ SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \ | |||
21 | file://run-ptest \ | 21 | file://run-ptest \ |
22 | file://fatal-loader.patch \ | 22 | file://fatal-loader.patch \ |
23 | file://0001-Add-use_prebuilt_tools-option.patch \ | 23 | file://0001-Add-use_prebuilt_tools-option.patch \ |
24 | file://CVE-2021-46829.patch \ | ||
25 | " | 24 | " |
26 | 25 | ||
27 | SRC_URI[sha256sum] = "c4a6b75b7ed8f58ca48da830b9fa00ed96d668d3ab4b1f723dcf902f78bde77f" | 26 | SRC_URI[sha256sum] = "c4a6b75b7ed8f58ca48da830b9fa00ed96d668d3ab4b1f723dcf902f78bde77f" |