diff options
| author |   Thomas Deutschmann <whissi@gentoo.org> | 2019-10-27 02:41:03 +0200 |
|---|---|---|
| committer | Thomas Deutschmann <whissi@gentoo.org> | 2019-10-27 02:41:03 +0200 |
| commit | e4782ac407f7b8744abf6bb7fe9e60bdd2dffa64 (patch) | |
| tree | 3b1df74b7f05a81250e3b6d065101cc57f964587 /sys-apps/file | |
| parent | media-gfx/graphicsmagick: security cleanup (#684320) (diff) | |
| download | gentoo-e4782ac407f7b8744abf6bb7fe9e60bdd2dffa64.tar.gz gentoo-e4782ac407f7b8744abf6bb7fe9e60bdd2dffa64.tar.bz2 gentoo-e4782ac407f7b8744abf6bb7fe9e60bdd2dffa64.zip | |
sys-apps/file: fix CVE-2019-18218
Bug: https://bugs.gentoo.org/698610
Package-Manager: Portage-2.3.78, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
Diffstat (limited to 'sys-apps/file')
| -rw-r--r-- | sys-apps/file/file-5.37-r1.ebuild (renamed from sys-apps/file/file-5.37.ebuild) | 2 | ||||
| -rw-r--r-- | sys-apps/file/files/file-5.37-CVE-2019-18218.patch | 36 |
2 files changed, 38 insertions, 0 deletions
diff --git a/sys-apps/file/file-5.37.ebuild b/sys-apps/file/file-5.37-r1.ebuild index 7aa0f8d8888c..5b6cf1db5d03 100644 --- a/sys-apps/file/file-5.37.ebuild +++ b/sys-apps/file/file-5.37-r1.ebuild @@ -33,6 +33,8 @@ DEPEND=" RDEPEND="${DEPEND} python? ( !dev-python/python-magic )" +PATCHES=( "${FILESDIR}"/${P}-CVE-2019-18218.patch ) + src_prepare() { default diff --git a/sys-apps/file/files/file-5.37-CVE-2019-18218.patch b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch new file mode 100644 index 000000000000..1cd02b778abf --- /dev/null +++ b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch @@ -0,0 +1,36 @@ +CVE-2019-18218 +https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 + +--- a/src/cdf.c ++++ b/src/cdf.c +@@ -1027,8 +1027,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + } + nelements = CDF_GETUINT32(q, 1); +- if (nelements == 0) { +- DPRINTF(("CDF_VECTOR with nelements == 0\n")); ++ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) { ++ DPRINTF(("CDF_VECTOR with nelements == %" ++ SIZE_T_FORMAT "u\n", nelements)); + goto out; + } + slen = 2; +@@ -1070,8 +1071,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + inp += nelem; + } +- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", +- nelements)); + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { +--- a/src/cdf.h ++++ b/src/cdf.h +@@ -48,6 +48,7 @@ + typedef int32_t cdf_secid_t; + + #define CDF_LOOP_LIMIT 10000 ++#define CDF_ELEMENT_LIMIT 100000 + + #define CDF_SECID_NULL 0 + #define CDF_SECID_FREE -1 |