[PATCH] gnu: gd: Fix CVE-2016-8670.

[PATCH] gnu: gd: Fix CVE-2016-8670.

[Kei Kebreau]

[-- Attachment #1.1: Type: text/plain, Size: 96 bytes --]

This patch fixes the gd library's most recent published vulnerability on
the oss-security list.

[-- Attachment #1.2: 0001-gnu-gd-Fix-CVE-2016-8670.patch --]
[-- Type: text/plain, Size: 2453 bytes --]

From dc48d5c020c0795c966501b83ac2d4b4ae0e4caa Mon Sep 17 00:00:00 2001
From: Kei Kebreau <kei@openmailbox.org>
Date: Sat, 15 Oct 2016 15:57:21 -0400
Subject: [PATCH] gnu: gd: Fix CVE-2016-8670.

* gnu/packages/patches/gd-CVE-2016-8670.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gd.scm (gd)[source]: Use it.
---
 gnu/local.mk                                |  1 +
 gnu/packages/gd.scm                         |  1 +
 gnu/packages/patches/gd-CVE-2016-8670.patch | 12 ++++++++++++
 3 files changed, 14 insertions(+)
 create mode 100644 gnu/packages/patches/gd-CVE-2016-8670.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index a151d2b..68b4bf3 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -536,6 +536,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/gcc-libvtv-runpath.patch			\
   %D%/packages/patches/gcc-5.0-libvtv-runpath.patch		\
   %D%/packages/patches/gd-CVE-2016-7568.patch			\
+  %D%/packages/patches/gd-CVE-2016-8670.patch			\
   %D%/packages/patches/gd-fix-gd2-read-test.patch		\
   %D%/packages/patches/gd-fix-tests-on-i686.patch		\
   %D%/packages/patches/gegl-CVE-2012-4433.patch			\
diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm
index 6c94d35..0241a81 100644
--- a/gnu/packages/gd.scm
+++ b/gnu/packages/gd.scm
@@ -51,6 +51,7 @@
               (base32
                "0g3xz8jpz1pl2zzmssglrpa9nxiaa7rmcmvgpbrjz8k9cyynqsvl"))
              (patches (search-patches "gd-CVE-2016-7568.patch"
+                                      "gd-CVE-2016-8670.patch"
                                       "gd-fix-gd2-read-test.patch"
                                       "gd-fix-tests-on-i686.patch"))))
     (build-system gnu-build-system)
diff --git a/gnu/packages/patches/gd-CVE-2016-8670.patch b/gnu/packages/patches/gd-CVE-2016-8670.patch
new file mode 100644
index 0000000..21d5fd9
--- /dev/null
+++ b/gnu/packages/patches/gd-CVE-2016-8670.patch
@@ -0,0 +1,12 @@
+diff -u -r libgd-2.2.3.old/src/gd_io_dp.c libgd-2.2.3/src/gd_io_dp.c
+--- libgd-2.2.3.old/src/gd_io_dp.c	1969-12-31 19:00:00.000000000 -0500
++++ libgd-2.2.3/src/gd_io_dp.c	2016-10-15 15:49:04.478163658 -0400
+@@ -276,7 +276,7 @@
+ 	if(remain >= len) {
+ 		rlen = len;
+ 	} else {
+-		if(remain == 0) {
++		if(remain <= 0) {
+ 			/* 2.0.34: EOF is incorrect. We use 0 for
+ 			 * errors and EOF, just like fileGetbuf,
+ 			 * which is a simple fread() wrapper.
-- 
2.10.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: [PATCH] gnu: gd: Fix CVE-2016-8670.

[Marius Bakke]

Kei Kebreau <kei@openmailbox.org> writes:

> This patch fixes the gd library's most recent published vulnerability on
> the oss-security list.

Looks like this was already applied by Leo in
e1376e25a755a7368d095b4eb2daf42be9e63b0d.

Re: [PATCH] gnu: gd: Fix CVE-2016-8670.

[Leo Famulari]

On Sat, Oct 15, 2016 at 10:55:52PM +0100, Marius Bakke wrote:
> Kei Kebreau <kei@openmailbox.org> writes:
> 
> > This patch fixes the gd library's most recent published vulnerability on
> > the oss-security list.
> 
> Looks like this was already applied by Leo in
> e1376e25a755a7368d095b4eb2daf42be9e63b0d.

It's always good to see what somebody else would have done. I'm glad our
patches made the same change in this case :)

Re: [PATCH] gnu: gd: Fix CVE-2016-8670.

[Kei Kebreau]

[-- Attachment #1: Type: text/plain, Size: 587 bytes --]

Leo Famulari <leo@famulari.name> writes:

> On Sat, Oct 15, 2016 at 10:55:52PM +0100, Marius Bakke wrote:
>> Kei Kebreau <kei@openmailbox.org> writes:
>> 
>> > This patch fixes the gd library's most recent published vulnerability on
>> > the oss-security list.
>> 
>> Looks like this was already applied by Leo in
>> e1376e25a755a7368d095b4eb2daf42be9e63b0d.
>
> It's always good to see what somebody else would have done. I'm glad our
> patches made the same change in this case :)

I see. Sometimes my tree gets behind on changes. Good thing it was only
a small patch!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]