unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed

blob 743fc6d3df00b193bb875d9ae8b1474f0c8ed128 831 bytes (raw)
name: gnu/packages/patches/gd-CVE-2017-7890.patch 	 # note: path name is non-authoritative(*)

From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001
From: LEPILLER Julien <julien.lepiller@irisa.fr>
Date: Thu, 3 Aug 2017 17:04:17 +0200
Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory.

The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.

This is CVE-2017-7890.
---
 src/gd_gif_in.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index 008d1ec..c195448 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd)
 
 	gdImagePtr im = 0;
 
+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	if(!ReadOK(fd, buf, 6)) {
 		return 0;
 	}
-- 
2.13.3

debug log:

solving 743fc6d3d ...
found 743fc6d3d in https://yhetil.org/guix-patches/20170803202200.730c7f63@lepiller.eu/

applying [1/1] https://yhetil.org/guix-patches/20170803202200.730c7f63@lepiller.eu/
diff --git a/gnu/packages/patches/gd-CVE-2017-7890.patch b/gnu/packages/patches/gd-CVE-2017-7890.patch
new file mode 100644
index 000000000..743fc6d3d

1:25: trailing whitespace.
 
1:26: space before tab in indent.
 	gdImagePtr im = 0;
1:27: trailing whitespace.
 
1:31: space before tab in indent.
 	if(!ReadOK(fd, buf, 6)) {
1:32: space before tab in indent.
 		return 0;
Checking patch gnu/packages/patches/gd-CVE-2017-7890.patch...
Applied patch gnu/packages/patches/gd-CVE-2017-7890.patch cleanly.
warning: squelched 3 whitespace errors
warning: 8 lines add whitespace errors.

index at:
100644 743fc6d3df00b193bb875d9ae8b1474f0c8ed128	gnu/packages/patches/gd-CVE-2017-7890.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).