25 lines
920 B
Diff
25 lines
920 B
Diff
|
Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
|
||
|
|
arbitrary code execution via crafted DICOM file).
|
||
|
|
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994
|
||
|
|
|
||
|
|
Copied from Fedora
|
||
|
|
https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb
|
||
|
|
|
||
|
|
diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
|
||
|
|
--- devil-1.7.8/src-IL/src/il_dicom.c~ 2009-03-08 08:10:09.000000000 +0100
|
||
|
|
+++ devil-1.7.8/src-IL/src/il_dicom.c 2009-12-03 12:07:45.000000000 +0100
|
||
|
|
@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
|
||
|
|
return IL_FALSE;
|
||
|
|
|
||
|
|
ValLen = GetLittleUShort();
|
||
|
|
+ if (ValLen > 64)
|
||
|
|
+ return IL_FALSE;
|
||
|
|
if (iread(UID, ValLen, 1) != 1)
|
||
|
|
return IL_FALSE;
|
||
|
|
- UID[64] = 0; // Just to make sure that our string is terminated.
|
||
|
|
+ UID[ValLen] = 0; // Just to make sure that our string is terminated.
|
||
|
|
|
||
|
|
return IL_TRUE;
|
||
|
|
}
|