nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnu: freeimage: Fix CVE-2016-5684. 

* gnu/packages/image.scm (freeimage)[source]: Add patch.
* gnu/packages/patches/freeimage-CVE-2016-5684.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Efraim Flashner 2016-10-14 11:28:21 +03:00
parent 0350a8bb1e
commit 76e8566c1b
No known key found for this signature in database
GPG Key ID: F4C1D3917EACEE93
3 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
gnu/local.mk
View File

@ -527,6 +527,7 @@ dist_patch_DATA = \
%D%/packages/patches/fontconfig-CVE-2016-5384.patch \
%D%/packages/patches/fontforge-svg-modtime.patch \
%D%/packages/patches/freeimage-CVE-2015-0852.patch \
%D%/packages/patches/freeimage-CVE-2016-5684.patch \
%D%/packages/patches/gawk-fts-test.patch \
%D%/packages/patches/gawk-shell.patch \
%D%/packages/patches/gcc-arm-link-spec-fix.patch \

3
gnu/packages/image.scm
View File

@ -581,7 +581,8 @@ supplies a generic doubly-linked list and some string functions.")
(sha256
(base32
"12bz57asdcfsz3zr9i9nska0fb6h3z2aizy412qjqkixkginbz7v"))
(patches (search-patches "freeimage-CVE-2015-0852.patch"))))
(patches (search-patches "freeimage-CVE-2015-0852.patch"
"freeimage-CVE-2016-5684.patch"))))
(build-system gnu-build-system)
(arguments
'(#:phases (alist-delete

34
gnu/packages/patches/freeimage-CVE-2016-5684.patch Normal file
View File

@ -0,0 +1,34 @@
From: Debian Science Maintainers
<debian-science-maintainers@lists.alioth.debian.org>
Date: Mon, 10 Oct 2016 08:22:44 +0100
Subject: CVE-2016-5684
---
Source/FreeImage/PluginXPM.cpp | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/Source/FreeImage/PluginXPM.cpp b/Source/FreeImage/PluginXPM.cpp
index a698321..cc7bd07 100644
--- a/Source/FreeImage/PluginXPM.cpp
+++ b/Source/FreeImage/PluginXPM.cpp
@@ -181,6 +181,11 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
}
free(str);
+ // check info string
+ if((width <= 0) || (height <= 0) || (colors <= 0) || (cpp <= 0)) {
+ throw "Improperly formed info string";
+ }
+
if (colors > 256) {
dib = FreeImage_AllocateHeader(header_only, width, height, 24, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
} else {
@@ -193,7 +198,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
FILE_RGBA rgba;
str = ReadString(io, handle);
- if(!str)
+ if(!str || (strlen(str) < (size_t)cpp))
throw "Error reading color strings";
std::string chrs(str,cpp); //create a string for the color chars using the first cpp chars