diff options
author | Andreas Sturmlechner <asturm@gentoo.org> | 2018-12-29 21:21:07 +0100 |
---|---|---|
committer | Andreas Sturmlechner <asturm@gentoo.org> | 2018-12-29 23:02:01 +0100 |
commit | 10ca5198d87e67194880e4421dc4a3d348211008 (patch) | |
tree | 8cd4bfe569aeb70eda73c2e7c516e0d1a7935de6 /media-libs/libextractor/files | |
parent | app-emulation/wine-any: Sync with ::wine (diff) | |
download | gentoo-10ca5198d87e67194880e4421dc4a3d348211008.tar.gz gentoo-10ca5198d87e67194880e4421dc4a3d348211008.tar.bz2 gentoo-10ca5198d87e67194880e4421dc4a3d348211008.zip |
media-libs/libextractor: Fix CVE-2018-20430, CVE-2018-20431
Bug: https://bugs.gentoo.org/673742
Package-Manager: Portage-2.3.52, Repoman-2.3.12
Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>
Diffstat (limited to 'media-libs/libextractor/files')
-rw-r--r-- | media-libs/libextractor/files/libextractor-1.8-CVE-2018-20430.patch | 49 | ||||
-rw-r--r-- | media-libs/libextractor/files/libextractor-1.8-CVE-2018-20431.patch | 39 |
2 files changed, 88 insertions, 0 deletions
diff --git a/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20430.patch b/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20430.patch new file mode 100644 index 000000000000..d0b5968606ba --- /dev/null +++ b/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20430.patch @@ -0,0 +1,49 @@ +From b405d707b36e0654900cba78e89f49779efea110 Mon Sep 17 00:00:00 2001 +From: Christian Grothoff <christian@grothoff.org> +Date: Thu, 20 Dec 2018 22:47:53 +0100 +Subject: fix #5493 (out of bounds read) + +--- + src/common/convert.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/common/convert.c b/src/common/convert.c +index c0edf21..2be2108 100644 +--- a/src/common/convert.c ++++ b/src/common/convert.c +@@ -36,8 +36,8 @@ + * string is returned. + */ + char * +-EXTRACTOR_common_convert_to_utf8 (const char *input, +- size_t len, ++EXTRACTOR_common_convert_to_utf8 (const char *input, ++ size_t len, + const char *charset) + { + #if HAVE_ICONV +@@ -52,7 +52,7 @@ EXTRACTOR_common_convert_to_utf8 (const char *input, + i = input; + cd = iconv_open ("UTF-8", charset); + if (cd == (iconv_t) - 1) +- return strdup (i); ++ return strndup (i, len); + if (len > 1024 * 1024) + { + iconv_close (cd); +@@ -67,11 +67,11 @@ EXTRACTOR_common_convert_to_utf8 (const char *input, + } + itmp = tmp; + finSize = tmpSize; +- if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == SIZE_MAX) ++ if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == ((size_t) -1)) + { + iconv_close (cd); + free (tmp); +- return strdup (i); ++ return strndup (i, len); + } + ret = malloc (tmpSize - finSize + 1); + if (ret == NULL) +-- +cgit v1.1 diff --git a/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20431.patch b/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20431.patch new file mode 100644 index 000000000000..2cd0448ba894 --- /dev/null +++ b/media-libs/libextractor/files/libextractor-1.8-CVE-2018-20431.patch @@ -0,0 +1,39 @@ +From 489c4a540bb2c4744471441425b8932b97a153e7 Mon Sep 17 00:00:00 2001 +From: Christian Grothoff <christian@grothoff.org> +Date: Thu, 20 Dec 2018 23:02:28 +0100 +Subject: fix #5494 + +--- + ChangeLog | 3 ++- + src/plugins/ole2_extractor.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/src/plugins/ole2_extractor.c b/src/plugins/ole2_extractor.c +index 53fa1b9..a48b726 100644 +--- a/src/plugins/ole2_extractor.c ++++ b/src/plugins/ole2_extractor.c +@@ -173,7 +173,7 @@ struct ProcContext + EXTRACTOR_MetaDataProcessor proc; + + /** +- * Closure for 'proc'. ++ * Closure for @e proc. + */ + void *proc_cls; + +@@ -213,7 +213,12 @@ process_metadata (gpointer key, + + if (G_VALUE_TYPE(gval) == G_TYPE_STRING) + { +- contents = strdup (g_value_get_string (gval)); ++ const char *gvals; ++ ++ gvals = g_value_get_string (gval); ++ if (NULL == gvals) ++ return; ++ contents = strdup (gvals); + } + else + { +-- +cgit v1.1 |