1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
| | Fix CVE-2020-18032:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-18032
https://gitlab.com/graphviz/graphviz/-/issues/1700
Patch copied from upstream source repository:
https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b
From 784411ca3655c80da0f6025ab20634b2a6ff696b Mon Sep 17 00:00:00 2001
From: Matthew Fernandez <matthew.fernandez@gmail.com>
Date: Sat, 25 Jul 2020 19:31:01 -0700
Subject: [PATCH] fix: out-of-bounds write on invalid label
When the label for a node cannot be parsed (due to it being malformed), it falls
back on the symbol name of the node itself. I.e. the default label the node
would have had if it had no label attribute at all. However, this is applied by
dynamically altering the node's label to "\N", a shortcut for the symbol name of
the node. All of this is fine, however if the hand written label itself is
shorter than the literal string "\N", not enough memory would have been
allocated to write "\N" into the label text.
Here we account for the possibility of error during label parsing, and assume
that the label text may need to be overwritten with "\N" after the fact. Fixes
issue #1700.
---
lib/common/shapes.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/common/shapes.c b/lib/common/shapes.c
index 0a0635fc3..9dca9ba6e 100644
--- a/lib/common/shapes.c
+++ b/lib/common/shapes.c
@@ -3546,9 +3546,10 @@ static void record_init(node_t * n)
reclblp = ND_label(n)->text;
len = strlen(reclblp);
/* For some forgotten reason, an empty label is parsed into a space, so
- * we need at least two bytes in textbuf.
+ * we need at least two bytes in textbuf, as well as accounting for the
+ * error path involving "\\N" below.
*/
- len = MAX(len, 1);
+ len = MAX(MAX(len, 1), (int)strlen("\\N"));
textbuf = N_NEW(len + 1, char);
if (!(info = parse_reclbl(n, flip, TRUE, textbuf))) {
agerr(AGERR, "bad label format %s\n", ND_label(n)->text);
--
2.31.1
|