1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
From 2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 22 Feb 2024 18:56:26 +1100
Subject: [PATCH] Use strncpy to avoid buffer overflow
CVE: CVE-2024-28219
Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
src/_imagingcms.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/_imagingcms.c b/src/_imagingcms.c
index 9b5a121d7..b839f09f0 100644
--- a/src/_imagingcms.c
+++ b/src/_imagingcms.c
@@ -201,8 +201,8 @@ cms_transform_new(cmsHTRANSFORM transform, char *mode_in, char *mode_out) {
self->transform = transform;
- strcpy(self->mode_in, mode_in);
- strcpy(self->mode_out, mode_out);
+ strncpy(self->mode_in, mode_in, 8);
+ strncpy(self->mode_out, mode_out, 8);
return (PyObject *)self;
}
@@ -244,8 +244,8 @@ findLCMStype(char *PILmode) {
}
else {
- /* take a wild guess... but you probably should fail instead. */
- return TYPE_GRAY_8; /* so there's no buffer overrun... */
+ /* take a wild guess... */
+ return TYPE_GRAY_8;
}
}
--
2.40.0
|
