mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2024-12-29 07:42:23 -05:00
0e7fb0cd9b
* gnu/packages/image.scm (optipng)[source](patches): New field. * gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it.
22 lines
889 B
Diff
22 lines
889 B
Diff
Fix CVE-2017-1000229:
|
|
|
|
https://security-tracker.debian.org/tracker/CVE-2017-1000229
|
|
https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html
|
|
https://nvd.nist.gov/vuln/detail/CVE-2017-1000229
|
|
|
|
Patch copied from upstream bug tracker:
|
|
https://sourceforge.net/p/optipng/bugs/65/
|
|
|
|
diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
|
|
index b4910ec..5f9b376 100644
|
|
--- a/src/minitiff/tiffread.c
|
|
+++ b/src/minitiff/tiffread.c
|
|
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
|
|
count = tiff_ptr->strip_offsets_count;
|
|
if (count == 0 || count > tiff_ptr->height)
|
|
goto err_invalid;
|
|
+ if (count > (size_t)-1 / sizeof(long))
|
|
+ goto err_memory;
|
|
tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
|
|
if (tiff_ptr->strip_offsets == NULL)
|
|
goto err_memory;
|