diff options
| author | Leo Famulari <[email protected]> | 2019-10-26 17:19:57 -0400 |
|---|---|---|
| committer | Leo Famulari <[email protected]> | 2019-10-28 12:47:59 -0400 |
| commit | 1051facc8108110e582f2c0a9d8a5fd38b1486b6 (patch) | |
| tree | a5414ad5800744f823fba7846a8532a00c82ab57 /gnu/packages/patches/file-CVE-2019-18218.patch | |
| parent | 7da3e81aa1b95ba2d72118e393c4531da44d5536 (diff) | |
gnu: file: Update to 5.37 [fixes CVE-2019-18218].
* gnu/packages/file.scm (file): Update to 5.37.
* gnu/packages/patches/file-CVE-2019-18218.patch: New file.
* gnu/packages/patches/file-CVE-2018-10360.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
Diffstat (limited to 'gnu/packages/patches/file-CVE-2019-18218.patch')
| -rw-r--r-- | gnu/packages/patches/file-CVE-2019-18218.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/gnu/packages/patches/file-CVE-2019-18218.patch b/gnu/packages/patches/file-CVE-2019-18218.patch new file mode 100644 index 0000000000..21069823b7 --- /dev/null +++ b/gnu/packages/patches/file-CVE-2019-18218.patch @@ -0,0 +1,55 @@ +Fix CVE-2019-18218: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218 + +Patch copied from upstream source repository: + +https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 + +From 46a8443f76cec4b41ec736eca396984c74664f84 Mon Sep 17 00:00:00 2001 +From: Christos Zoulas <[email protected]> +Date: Mon, 26 Aug 2019 14:31:39 +0000 +Subject: [PATCH] Limit the number of elements in a vector (found by oss-fuzz) + +--- + src/cdf.c | 9 ++++----- + src/cdf.h | 1 + + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/cdf.c b/src/cdf.c +index 9d6396742..bb81d6374 100644 +--- a/src/cdf.c ++++ b/src/cdf.c +@@ -1027,8 +1027,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + } + nelements = CDF_GETUINT32(q, 1); +- if (nelements == 0) { +- DPRINTF(("CDF_VECTOR with nelements == 0\n")); ++ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) { ++ DPRINTF(("CDF_VECTOR with nelements == %" ++ SIZE_T_FORMAT "u\n", nelements)); + goto out; + } + slen = 2; +@@ -1070,8 +1071,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + inp += nelem; + } +- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", +- nelements)); + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { +diff --git a/src/cdf.h b/src/cdf.h +index 2f7e554b7..05056668f 100644 +--- a/src/cdf.h ++++ b/src/cdf.h +@@ -48,6 +48,7 @@ + typedef int32_t cdf_secid_t; + + #define CDF_LOOP_LIMIT 10000 ++#define CDF_ELEMENT_LIMIT 100000 + + #define CDF_SECID_NULL 0 + #define CDF_SECID_FREE -1 |