[PATCH] gnu: optipng: Fix CVE-2017-1000229.

DoneSubmitted by Marius Bakke.
Details
3 participants
  • Leo Famulari
  • Ludovic Courtès
  • Marius Bakke
Owner
unassigned
Severity
normal
M
M
Marius Bakke wrote on 28 Nov 2017 18:01
(address . guix-patches@gnu.org)(name . Marius Bakke)(address . mbakke@fastmail.com)
20171128170150.29946-1-mbakke@fastmail.com
* gnu/packages/image.scm (optipng)[source](patches): New field.* gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file.* gnu/local.mk (dist_patch_DATA): Register it.--- gnu/local.mk | 1 + gnu/packages/image.scm | 1 + .../patches/optipng-CVE-2017-1000229.patch | 22 ++++++++++++++++++++++ 3 files changed, 24 insertions(+) create mode 100644 gnu/packages/patches/optipng-CVE-2017-1000229.patch
Toggle diff (54 lines)diff --git a/gnu/local.mk b/gnu/local.mkindex ebff7084b..26845954e 100644--- a/gnu/local.mk+++ b/gnu/local.mk@@ -938,6 +938,7 @@ dist_patch_DATA = \ %D%/packages/patches/openssl-runpath.patch \ %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch \ %D%/packages/patches/openssl-c-rehash-in.patch \+ %D%/packages/patches/optipng-CVE-2017-1000229.patch \ %D%/packages/patches/orpheus-cast-errors-and-includes.patch \ %D%/packages/patches/osip-CVE-2017-7853.patch \ %D%/packages/patches/ots-no-include-missing-file.patch \diff --git a/gnu/packages/image.scm b/gnu/packages/image.scmindex 0e1f02556..b9f1ef234 100644--- a/gnu/packages/image.scm+++ b/gnu/packages/image.scm@@ -1095,6 +1095,7 @@ installed as @code{stb_image}.") (method url-fetch) (uri (string-append "http://prdownloads.sourceforge.net/optipng/optipng-" version ".tar.gz"))+ (patches (search-patches "optipng-CVE-2017-1000229.patch")) (sha256 (base32 "105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28"))))diff --git a/gnu/packages/patches/optipng-CVE-2017-1000229.patch b/gnu/packages/patches/optipng-CVE-2017-1000229.patchnew file mode 100644index 000000000..2cb3b2f21--- /dev/null+++ b/gnu/packages/patches/optipng-CVE-2017-1000229.patch@@ -0,0 +1,22 @@+Fix CVE-2017-1000229:++https://security-tracker.debian.org/tracker/CVE-2017-1000229+https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html+https://nvd.nist.gov/vuln/detail/CVE-2017-1000229++Patch copied from upstream bug tracker:+https://sourceforge.net/p/optipng/bugs/65/++diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c+index b4910ec..5f9b376 100644+--- a/src/minitiff/tiffread.c++++ b/src/minitiff/tiffread.c+@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)+ count = tiff_ptr->strip_offsets_count;+ if (count == 0 || count > tiff_ptr->height)+ goto err_invalid;++ if (count > (size_t)-1 / sizeof(long))++ goto err_memory;+ tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));+ if (tiff_ptr->strip_offsets == NULL)+ goto err_memory;-- 2.15.0
L
L
Leo Famulari wrote on 28 Nov 2017 19:20
(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 29486@debbugs.gnu.org)
20171128182002.GE14200@jasmine.lan
On Tue, Nov 28, 2017 at 06:01:50PM +0100, Marius Bakke wrote:
Toggle quote (4 lines)> * gnu/packages/image.scm (optipng)[source](patches): New field.> * gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file.> * gnu/local.mk (dist_patch_DATA): Register it.
LGTM, thanks!
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlodqNIACgkQJkb6MLrKfwjdmhAAzB8kZCIDSPBfUz+IY8nwyb8WfdgxsUO7rs4t6qXNjhbBi/QKDvz7Nhq8QdeNdicd5Z0yaDL0c4pa/GTfZuIILHZ18lf7n0WbpqIGdeuXR7F7dKB//SrcwzNxpm98X+QpEUivq8bY0Klw1nozZZRmPmFlCYDH4UHTobO/fK6BtqTEeT8dTpSdL2epsFKX4yugoemWR6lASEC0bSOY0SSShxVKHvib2VSErrYtcNpkwQ0fDhRxYEevpzbdotldHpcfAt6w4Da90GExQ+WpDKzzzwS9s7qEnkRPHhm+C3eoMAYzA59zLhrhVuQrVIbV48UMGe7Fe4uYfvY3IORjLtrvVdHjRJui52YQDyeRs16rod0ke62Noy75aKprZlEmBfpNBw0r5cAIvY3y1Tu72Tn+AgBhNXDUe1fG/kRlKUWu2Ll+oR1wsPFIOUrXwfr8F2es8Gf3KKxPQ3EXenWyKZuohX3oLy2ooFLPIbKvBJbdENqIownEZf61cWHN9ml1K4oykn+jkXNi9GJBA+vp9vAPKBU/jhKGmqwZcBPg4rWxgwV35xWJEuDmqRihNpmhhIItO0vWZbYNvYWQmmEpPOq68AeZXhH+oqa0N+qil2qmN2Mu0oWzDBp0pA2QY1ENe3h3wjF7tPGw7ZN11xgoXls64PZZBt27Y2sNFB4CVGuqEzA==BuCS-----END PGP SIGNATURE-----

L
L
Ludovic Courtès wrote on 30 Nov 2017 16:03
control message for bug #29486
(address . control@debbugs.gnu.org)
87wp273j1y.fsf@gnu.org
tags 29486 fixedclose 29486
?
Your comment

This issue is archived.

To comment on this conversation send email to 29486@debbugs.gnu.org