diff options
Diffstat (limited to 'meta/recipes-extended/cups/cups/cups-CVE-2011-3170.patch')
-rw-r--r-- | meta/recipes-extended/cups/cups/cups-CVE-2011-3170.patch | 54 |
1 files changed, 0 insertions, 54 deletions
diff --git a/meta/recipes-extended/cups/cups/cups-CVE-2011-3170.patch b/meta/recipes-extended/cups/cups/cups-CVE-2011-3170.patch deleted file mode 100644 index fd1b95847c..0000000000 --- a/meta/recipes-extended/cups/cups/cups-CVE-2011-3170.patch +++ /dev/null | |||
@@ -1,54 +0,0 @@ | |||
1 | cups CVE-2011-3170 | ||
2 | |||
3 | the patch come from: | ||
4 | http://cups.org/strfiles/3914/str3914.patch | ||
5 | |||
6 | The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and | ||
7 | earlier does not properly handle the first code word in an LZW stream, | ||
8 | which allows remote attackers to trigger a heap-based buffer overflow, | ||
9 | and possibly execute arbitrary code, via a crafted stream, a different | ||
10 | vulnerability than CVE-2011-2896. | ||
11 | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170 | ||
12 | |||
13 | Integrated-by: Li Wang <li.wang@windriver.com> | ||
14 | --- | ||
15 | filter/image-gif.c | 14 +++++++++----- | ||
16 | 1 files changed, 9 insertions(+), 5 deletions(-) | ||
17 | |||
18 | diff --git a/filter/image-gif.c b/filter/image-gif.c | ||
19 | index 9542704..3857c21 100644 | ||
20 | --- a/filter/image-gif.c | ||
21 | +++ b/filter/image-gif.c | ||
22 | @@ -654,11 +654,13 @@ gif_read_lzw(FILE *fp, /* I - File to read from */ | ||
23 | |||
24 | if (code >= max_code) | ||
25 | { | ||
26 | - *sp++ = firstcode; | ||
27 | - code = oldcode; | ||
28 | + if (sp < (stack + 8192)) | ||
29 | + *sp++ = firstcode; | ||
30 | + | ||
31 | + code = oldcode; | ||
32 | } | ||
33 | |||
34 | - while (code >= clear_code) | ||
35 | + while (code >= clear_code && sp < (stack + 8192)) | ||
36 | { | ||
37 | *sp++ = table[1][code]; | ||
38 | if (code == table[0][code]) | ||
39 | @@ -667,8 +669,10 @@ gif_read_lzw(FILE *fp, /* I - File to read from */ | ||
40 | code = table[0][code]; | ||
41 | } | ||
42 | |||
43 | - *sp++ = firstcode = table[1][code]; | ||
44 | - code = max_code; | ||
45 | + if (sp < (stack + 8192)) | ||
46 | + *sp++ = firstcode = table[1][code]; | ||
47 | + | ||
48 | + code = max_code; | ||
49 | |||
50 | if (code < 4096) | ||
51 | { | ||
52 | -- | ||
53 | 1.7.0.5 | ||
54 | |||