summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/graphviz-CVE-2020-18032.patch
diff options
context:
space:
mode:
authorMaxim Cournoyer <[email protected]>2022-01-25 22:07:13 -0500
committerMaxim Cournoyer <[email protected]>2022-01-25 22:07:13 -0500
commit1a5302435ff0d2822b823f5a6fe01faa7a85c629 (patch)
treeac7810c88b560532f22d2bab2e59609cd7305c21 /gnu/packages/patches/graphviz-CVE-2020-18032.patch
parent3ff2ac4980dacf10087e4b42bd9fbc490591900c (diff)
parent070b8a893febd6e7d8b2b7c8c4dcebacf7845aa9 (diff)
Merge branch 'master' into staging.
With "conflicts" solved (all in favor of master except git) in: gnu/local.mk gnu/packages/databases.scm gnu/packages/glib.scm gnu/packages/gnome.scm gnu/packages/gnupg.scm gnu/packages/gnuzilla.scm gnu/packages/graphics.scm gnu/packages/gstreamer.scm gnu/packages/gtk.scm gnu/packages/linux.scm gnu/packages/machine-learning.scm gnu/packages/networking.scm gnu/packages/polkit.scm gnu/packages/pulseaudio.scm gnu/packages/rpc.scm gnu/packages/rust.scm gnu/packages/version-control.scm gnu/packages/w3m.scm
Diffstat (limited to 'gnu/packages/patches/graphviz-CVE-2020-18032.patch')
-rw-r--r--gnu/packages/patches/graphviz-CVE-2020-18032.patch49
1 files changed, 0 insertions, 49 deletions
diff --git a/gnu/packages/patches/graphviz-CVE-2020-18032.patch b/gnu/packages/patches/graphviz-CVE-2020-18032.patch
deleted file mode 100644
index 4cf94a9a36..0000000000
--- a/gnu/packages/patches/graphviz-CVE-2020-18032.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-Fix CVE-2020-18032:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-18032
-https://gitlab.com/graphviz/graphviz/-/issues/1700
-
-Patch copied from upstream source repository:
-
-https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b
-
-From 784411ca3655c80da0f6025ab20634b2a6ff696b Mon Sep 17 00:00:00 2001
-From: Matthew Fernandez <[email protected]>
-Date: Sat, 25 Jul 2020 19:31:01 -0700
-Subject: [PATCH] fix: out-of-bounds write on invalid label
-
-When the label for a node cannot be parsed (due to it being malformed), it falls
-back on the symbol name of the node itself. I.e. the default label the node
-would have had if it had no label attribute at all. However, this is applied by
-dynamically altering the node's label to "\N", a shortcut for the symbol name of
-the node. All of this is fine, however if the hand written label itself is
-shorter than the literal string "\N", not enough memory would have been
-allocated to write "\N" into the label text.
-
-Here we account for the possibility of error during label parsing, and assume
-that the label text may need to be overwritten with "\N" after the fact. Fixes
-issue #1700.
----
- lib/common/shapes.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/lib/common/shapes.c b/lib/common/shapes.c
-index 0a0635fc3..9dca9ba6e 100644
---- a/lib/common/shapes.c
-+++ b/lib/common/shapes.c
-@@ -3546,9 +3546,10 @@ static void record_init(node_t * n)
- reclblp = ND_label(n)->text;
- len = strlen(reclblp);
- /* For some forgotten reason, an empty label is parsed into a space, so
-- * we need at least two bytes in textbuf.
-+ * we need at least two bytes in textbuf, as well as accounting for the
-+ * error path involving "\\N" below.
- */
-- len = MAX(len, 1);
-+ len = MAX(MAX(len, 1), (int)strlen("\\N"));
- textbuf = N_NEW(len + 1, char);
- if (!(info = parse_reclbl(n, flip, TRUE, textbuf))) {
- agerr(AGERR, "bad label format %s\n", ND_label(n)->text);
---
-2.31.1
-