guix-devel/gnu/packages/patches/gd-CVE-2017-7890.patch

31 lines
825 B
Diff

From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001
From: LEPILLER Julien <julien@lepiller.eu>
Date: Thu, 3 Aug 2017 17:04:17 +0200
Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory.
The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.
This is CVE-2017-7890.
---
src/gd_gif_in.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index 008d1ec..c195448 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd)
gdImagePtr im = 0;
+ memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+ memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
if(!ReadOK(fd, buf, 6)) {
return 0;
}
--
2.13.3