On Fri, Aug 04, 2017 at 08:30:08AM +0200, Julien Lepiller wrote:
> >> +From: LEPILLER Julien <julien.lepiller@irisa.fr>
> >> +Date: Thu, 3 Aug 2017 17:04:17 +0200
> >> +Subject: [PATCH] Fix #399: Buffer over-read into uninitialized
> >memory.
> >> +
> >> +The stack allocated color map buffers were not zeroed before usage,
> >and
> >> +so undefined palette indexes could cause information leakage.
> >> +
> >> +This is CVE-2017-7890.
> >
> >Would this patch be valuable for the "regular" gd package as well, or
> >is
> >it specific to gd-for-php?
> 
> It could be used for gd, but I think it would trigger a lot of
> rebuilds. I'm not confident with how the graft mechanism works, so I
> would need some help.

Okay, I'll look into it this weekend, unless somebody beats me to it.

Next time there are lots of Guix people gathered together, I want to
hold some kind of "security updates workshop", with the goal of helping
more people feel comfortable working in this area.

For gd in particular, if you have some specific questions, I can answer
them over email. Surely more people have questions, too. The discussion
could result in improvements to the manual's section on this topic.

> Arg... those are tabs I guess. Thanks for the review! I will push it
> this evening if everything is ok.

Great!