From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kei Kebreau Subject: [PATCH] gnu: gd: Fix CVE-2016-8670. Date: Sat, 15 Oct 2016 15:59:58 -0400 Message-ID: <87bmylcri9.fsf@openmailbox.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:40439) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bvV7u-0007qo-Tt for guix-devel@gnu.org; Sat, 15 Oct 2016 16:00:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bvV7r-0005gL-T1 for guix-devel@gnu.org; Sat, 15 Oct 2016 16:00:15 -0400 Received: from smtp9.openmailbox.org ([62.4.1.43]:60283) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1bvV7r-0005fm-Kz for guix-devel@gnu.org; Sat, 15 Oct 2016 16:00:11 -0400 List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org --==-=-= Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain This patch fixes the gd library's most recent published vulnerability on the oss-security list. --=-=-= Content-Type: text/plain Content-Disposition: attachment; filename=0001-gnu-gd-Fix-CVE-2016-8670.patch Content-Transfer-Encoding: quoted-printable From=20dc48d5c020c0795c966501b83ac2d4b4ae0e4caa Mon Sep 17 00:00:00 2001 From: Kei Kebreau Date: Sat, 15 Oct 2016 15:57:21 -0400 Subject: [PATCH] gnu: gd: Fix CVE-2016-8670. * gnu/packages/patches/gd-CVE-2016-8670.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/gd.scm (gd)[source]: Use it. =2D-- gnu/local.mk | 1 + gnu/packages/gd.scm | 1 + gnu/packages/patches/gd-CVE-2016-8670.patch | 12 ++++++++++++ 3 files changed, 14 insertions(+) create mode 100644 gnu/packages/patches/gd-CVE-2016-8670.patch diff --git a/gnu/local.mk b/gnu/local.mk index a151d2b..68b4bf3 100644 =2D-- a/gnu/local.mk +++ b/gnu/local.mk @@ -536,6 +536,7 @@ dist_patch_DATA =3D \ %D%/packages/patches/gcc-libvtv-runpath.patch \ %D%/packages/patches/gcc-5.0-libvtv-runpath.patch \ %D%/packages/patches/gd-CVE-2016-7568.patch \ + %D%/packages/patches/gd-CVE-2016-8670.patch \ %D%/packages/patches/gd-fix-gd2-read-test.patch \ %D%/packages/patches/gd-fix-tests-on-i686.patch \ %D%/packages/patches/gegl-CVE-2012-4433.patch \ diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm index 6c94d35..0241a81 100644 =2D-- a/gnu/packages/gd.scm +++ b/gnu/packages/gd.scm @@ -51,6 +51,7 @@ (base32 "0g3xz8jpz1pl2zzmssglrpa9nxiaa7rmcmvgpbrjz8k9cyynqsvl")) (patches (search-patches "gd-CVE-2016-7568.patch" + "gd-CVE-2016-8670.patch" "gd-fix-gd2-read-test.patch" "gd-fix-tests-on-i686.patch")))) (build-system gnu-build-system) diff --git a/gnu/packages/patches/gd-CVE-2016-8670.patch b/gnu/packages/pat= ches/gd-CVE-2016-8670.patch new file mode 100644 index 0000000..21d5fd9 =2D-- /dev/null +++ b/gnu/packages/patches/gd-CVE-2016-8670.patch @@ -0,0 +1,12 @@ +diff -u -r libgd-2.2.3.old/src/gd_io_dp.c libgd-2.2.3/src/gd_io_dp.c +--- libgd-2.2.3.old/src/gd_io_dp.c 1969-12-31 19:00:00.000000000 -0500 ++++ libgd-2.2.3/src/gd_io_dp.c 2016-10-15 15:49:04.478163658 -0400 +@@ -276,7 +276,7 @@ + if(remain >=3D len) { + rlen =3D len; + } else { +- if(remain =3D=3D 0) { ++ if(remain <=3D 0) { + /* 2.0.34: EOF is incorrect. We use 0 for + * errors and EOF, just like fileGetbuf, + * which is a simple fread() wrapper. =2D-=20 2.10.1 --=-=-=-- --==-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJYAoq/AAoJEOal7jwZRnoNYyQQAKW4sDyuMMKk5zjY7/vko933 yD9M9uBAPjG41c/eIa21utQ3RrI9x8l1bl3l9kUs1X/YdW3hivVT4kC1th/DuvXK pIw9JOW2zR3IU52dltlxJfgrPPM8zMxeNneppGg9bma4+cyFfVpnqjPCC2qcxh8t eSgvIEWPzCBQHuu/J/I3BkU9Yz9kY4vle6g2Tel4fX9WoLwSsgMik6p6hNz9KcF5 uRAbQxziLzfITdp6sQAAKcsDuKZqA8hmNzwvGkO533gN2NUD8QHwnCapNyKwHsh0 LvMU/PGXKYUaMHZ+LQWFYGDEJyPmHeIUT4xSO08uunJMG8K1TgEw+dFazRZkdMVn jYI6ZdJ3BxzXdvEoUxg5YhgadGSbpciE4Os9MfJKkkNGGk/vPg/+wlbmUSRsGsIP OJ7Bv3vN5RQ4dikE6vLfpfDx6SeBqf9w/c+F2xBPcngJqXwX5ob/XAk0ac15nqqP 3/AdgZUgE0iUqwtkXX5N6D33kli4vmx/ANTxxpwodg+JBddQSsRhojWDcct0Xofq A/wOp6KZ9BklFbjzkpb+95sCkABmgUhwqbLmnAsTsmXO9pMJl/I/k60oYWgGD4TB J7cWvwZK+QJNW63zaQXMMTTQx3CH+1EnYdvl1Q2GD9ftNC6O0KGsfv/IRd7Sjrj/ 4CtNFTz+/RS1enm+BVoS =m3Ur -----END PGP SIGNATURE----- --==-=-=--