mirror/guix
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/guix.git synced 2025-01-19 05:57:04 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: optipng: Fix CVE-2017-1000229.

Browse source 
* gnu/packages/image.scm (optipng)[source](patches): New field.
* gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Marius Bakke 2017-11-28 17:41:33 +01:00
parent efa6a1ddb5
commit 0e7fb0cd9b
No known key found for this signature in database
GPG key ID: A2A06DF2A33A54FA
3 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
gnu/local.mk
View file

@ -940,6 +940,7 @@ dist_patch_DATA = \
%D%/packages/patches/openssl-runpath.patch \
%D%/packages/patches/openssl-1.1.0-c-rehash-in.patch \
%D%/packages/patches/openssl-c-rehash-in.patch \
%D%/packages/patches/optipng-CVE-2017-1000229.patch \
%D%/packages/patches/orpheus-cast-errors-and-includes.patch \
%D%/packages/patches/osip-CVE-2017-7853.patch \
%D%/packages/patches/ots-no-include-missing-file.patch \

1
gnu/packages/image.scm
View file

@ -1095,6 +1095,7 @@ (define-public optipng
(method url-fetch)
(uri (string-append "http://prdownloads.sourceforge.net/optipng/optipng-"
version ".tar.gz"))
(patches (search-patches "optipng-CVE-2017-1000229.patch"))
(sha256
(base32
"105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28"))))

22
gnu/packages/patches/optipng-CVE-2017-1000229.patch Normal file
View file

@ -0,0 +1,22 @@
Fix CVE-2017-1000229:
https://security-tracker.debian.org/tracker/CVE-2017-1000229
https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html
https://nvd.nist.gov/vuln/detail/CVE-2017-1000229
Patch copied from upstream bug tracker:
https://sourceforge.net/p/optipng/bugs/65/
diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
index b4910ec..5f9b376 100644
--- a/src/minitiff/tiffread.c
+++ b/src/minitiff/tiffread.c
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
count = tiff_ptr->strip_offsets_count;
if (count == 0 || count > tiff_ptr->height)
goto err_invalid;
+ if (count > (size_t)-1 / sizeof(long))
+ goto err_memory;
tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
if (tiff_ptr->strip_offsets == NULL)
goto err_memory;