r52356 - in /desktop/unstable/libcroco/debian: changelog patches/CVE-2017-7960-heap-buffer-overflow.patch patches/CVE-2017-7961-double-to-long-check.patch patches/series

pochu at users.alioth.debian.org pochu at users.alioth.debian.org
Sun Apr 23 11:16:44 UTC 2017


Author: pochu
Date: Sun Apr 23 11:16:44 2017
New Revision: 52356

URL: http://svn.debian.org/wsvn/pkg-gnome/?sc=1&rev=52356
Log:
* CVE-2017-7960-heap-buffer-overflow.patch:
  - CVE-2017-7960: check end of input before reading from buffer.
* CVE-2017-7961-double-to-long-check.patch:
  - CVE-2017-7961: check color value before converting to long.
* The above closes: #860961.

Added:
    desktop/unstable/libcroco/debian/patches/CVE-2017-7960-heap-buffer-overflow.patch
    desktop/unstable/libcroco/debian/patches/CVE-2017-7961-double-to-long-check.patch
Modified:
    desktop/unstable/libcroco/debian/changelog
    desktop/unstable/libcroco/debian/patches/series

Modified: desktop/unstable/libcroco/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/unstable/libcroco/debian/changelog?rev=52356&op=diff
==============================================================================
--- desktop/unstable/libcroco/debian/changelog	[utf-8] (original)
+++ desktop/unstable/libcroco/debian/changelog	[utf-8] Sun Apr 23 11:16:44 2017
@@ -1,3 +1,13 @@
+libcroco (0.6.11-3) UNRELEASED; urgency=medium
+
+  * CVE-2017-7960-heap-buffer-overflow.patch:
+    - CVE-2017-7960: check end of input before reading from buffer.
+  * CVE-2017-7961-double-to-long-check.patch:
+    - CVE-2017-7961: check color value before converting to long.
+  * The above closes: #860961.
+
+ -- Emilio Pozuelo Monfort <pochu at debian.org>  Sun, 23 Apr 2017 13:01:50 +0200
+
 libcroco (0.6.11-2) unstable; urgency=medium
 
   * Convert from cdbs to dh.

Added: desktop/unstable/libcroco/debian/patches/CVE-2017-7960-heap-buffer-overflow.patch
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/unstable/libcroco/debian/patches/CVE-2017-7960-heap-buffer-overflow.patch?rev=52356&op=file
==============================================================================
--- desktop/unstable/libcroco/debian/patches/CVE-2017-7960-heap-buffer-overflow.patch	(added)
+++ desktop/unstable/libcroco/debian/patches/CVE-2017-7960-heap-buffer-overflow.patch	[utf-8] Sun Apr 23 11:16:44 2017
@@ -0,0 +1,58 @@
+From 898e3a8c8c0314d2e6b106809a8e3e93cf9d4394 Mon Sep 17 00:00:00 2001
+From: Ignacio Casal Quinteiro <qignacio at amazon.com>
+Date: Sun, 16 Apr 2017 13:13:43 +0200
+Subject: input: check end of input before reading a byte
+
+When reading bytes we weren't check that the index wasn't
+out of bound and this could produce an invalid read which
+could deal to a security bug.
+---
+ src/cr-input.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/src/cr-input.c b/src/cr-input.c
+index 49000b1..3b63a88 100644
+--- a/src/cr-input.c
++++ b/src/cr-input.c
+@@ -256,7 +256,7 @@ cr_input_new_from_uri (const gchar * a_file_uri, enum CREncoding a_enc)
+                  *we should  free buf here because it's own by CRInput.
+                  *(see the last parameter of cr_input_new_from_buf().
+                  */
+-                buf = NULL ;
++                buf = NULL;
+         }
+ 
+  cleanup:
+@@ -404,6 +404,8 @@ cr_input_get_nb_bytes_left (CRInput const * a_this)
+ enum CRStatus
+ cr_input_read_byte (CRInput * a_this, guchar * a_byte)
+ {
++        gulong nb_bytes_left = 0;
++
+         g_return_val_if_fail (a_this && PRIVATE (a_this)
+                               && a_byte, CR_BAD_PARAM_ERROR);
+ 
+@@ -413,6 +415,12 @@ cr_input_read_byte (CRInput * a_this, guchar * a_byte)
+         if (PRIVATE (a_this)->end_of_input == TRUE)
+                 return CR_END_OF_INPUT_ERROR;
+ 
++        nb_bytes_left = cr_input_get_nb_bytes_left (a_this);
++
++        if (nb_bytes_left < 1) {
++                return CR_END_OF_INPUT_ERROR;
++        }
++
+         *a_byte = PRIVATE (a_this)->in_buf[PRIVATE (a_this)->next_byte_index];
+ 
+         if (PRIVATE (a_this)->nb_bytes -
+@@ -477,7 +485,6 @@ cr_input_read_char (CRInput * a_this, guint32 * a_char)
+                 if (*a_char == '\n') {
+                         PRIVATE (a_this)->end_of_line = TRUE;
+                 }
+-
+         }
+ 
+         return status;
+-- 
+cgit v0.12
+

Added: desktop/unstable/libcroco/debian/patches/CVE-2017-7961-double-to-long-check.patch
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/unstable/libcroco/debian/patches/CVE-2017-7961-double-to-long-check.patch?rev=52356&op=file
==============================================================================
--- desktop/unstable/libcroco/debian/patches/CVE-2017-7961-double-to-long-check.patch	(added)
+++ desktop/unstable/libcroco/debian/patches/CVE-2017-7961-double-to-long-check.patch	[utf-8] Sun Apr 23 11:16:44 2017
@@ -0,0 +1,42 @@
+From 9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Mon Sep 17 00:00:00 2001
+From: Ignacio Casal Quinteiro <qignacio at amazon.com>
+Date: Sun, 16 Apr 2017 13:56:09 +0200
+Subject: tknzr: support only max long rgb values
+
+This fixes a possible out of bound when reading rgbs which
+are longer than the support MAXLONG
+---
+ src/cr-tknzr.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/cr-tknzr.c b/src/cr-tknzr.c
+index 1a7cfeb..1548c35 100644
+--- a/src/cr-tknzr.c
++++ b/src/cr-tknzr.c
+@@ -1279,6 +1279,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
+         status = cr_tknzr_parse_num (a_this, &num);
+         ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
+ 
++        if (num->val > G_MAXLONG) {
++                status = CR_PARSING_ERROR;
++                goto error;
++        }
++
+         red = num->val;
+         cr_num_destroy (num);
+         num = NULL;
+@@ -1298,6 +1303,11 @@ cr_tknzr_parse_rgb (CRTknzr * a_this, CRRgb ** a_rgb)
+                 status = cr_tknzr_parse_num (a_this, &num);
+                 ENSURE_PARSING_COND ((status == CR_OK) && (num != NULL));
+ 
++                if (num->val > G_MAXLONG) {
++                        status = CR_PARSING_ERROR;
++                        goto error;
++                }
++
+                 PEEK_BYTE (a_this, 1, &next_bytes[0]);
+                 if (next_bytes[0] == '%') {
+                         SKIP_CHARS (a_this, 1);
+-- 
+cgit v0.12
+

Modified: desktop/unstable/libcroco/debian/patches/series
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/unstable/libcroco/debian/patches/series?rev=52356&op=diff
==============================================================================
--- desktop/unstable/libcroco/debian/patches/series	[utf-8] (original)
+++ desktop/unstable/libcroco/debian/patches/series	[utf-8] Sun Apr 23 11:16:44 2017
@@ -0,0 +1,2 @@
+CVE-2017-7960-heap-buffer-overflow.patch
+CVE-2017-7961-double-to-long-check.patch




More information about the pkg-gnome-commits mailing list