mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2024-12-24 21:38:07 -05:00
gnu: devil: Fix CVE-2009-3994.
* gnu/packages/patches/devil-CVE-2009-3994.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/image.scm (devil): Use it.
This commit is contained in:
parent
ac9fc78ff0
commit
726f088884
3 changed files with 27 additions and 1 deletions
|
@ -460,6 +460,7 @@ dist_patch_DATA = \
|
|||
%D%/packages/patches/cursynth-wave-rand.patch \
|
||||
%D%/packages/patches/dbus-helper-search-path.patch \
|
||||
%D%/packages/patches/dealii-p4est-interface.patch \
|
||||
%D%/packages/patches/devil-CVE-2009-3994.patch \
|
||||
%D%/packages/patches/devil-fix-libpng.patch \
|
||||
%D%/packages/patches/dico-libtool-deterministic.patch \
|
||||
%D%/packages/patches/diffutils-gets-undeclared.patch \
|
||||
|
|
|
@ -693,7 +693,8 @@ (define-public devil
|
|||
"1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8"))
|
||||
;; Backported from upstream:
|
||||
;; https://github.com/DentonW/DevIL/commit/724194d7a9a91221a564579f64bdd6f0abd64219.patch
|
||||
(patches (search-patches "devil-fix-libpng.patch"))
|
||||
(patches (search-patches "devil-fix-libpng.patch"
|
||||
"devil-CVE-2009-3994.patch"))
|
||||
(modules '((guix build utils)))
|
||||
(snippet
|
||||
;; Fix old lcms include directives and lib flags.
|
||||
|
|
24
gnu/packages/patches/devil-CVE-2009-3994.patch
Normal file
24
gnu/packages/patches/devil-CVE-2009-3994.patch
Normal file
|
@ -0,0 +1,24 @@
|
|||
Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
|
||||
arbitrary code execution via crafted DICOM file).
|
||||
|
||||
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994
|
||||
|
||||
Copied from Fedora
|
||||
https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb
|
||||
|
||||
diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
|
||||
--- devil-1.7.8/src-IL/src/il_dicom.c~ 2009-03-08 08:10:09.000000000 +0100
|
||||
+++ devil-1.7.8/src-IL/src/il_dicom.c 2009-12-03 12:07:45.000000000 +0100
|
||||
@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
|
||||
return IL_FALSE;
|
||||
|
||||
ValLen = GetLittleUShort();
|
||||
+ if (ValLen > 64)
|
||||
+ return IL_FALSE;
|
||||
if (iread(UID, ValLen, 1) != 1)
|
||||
return IL_FALSE;
|
||||
- UID[64] = 0; // Just to make sure that our string is terminated.
|
||||
+ UID[ValLen] = 0; // Just to make sure that our string is terminated.
|
||||
|
||||
return IL_TRUE;
|
||||
}
|
Loading…
Reference in a new issue