guix-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

01/01: gnu: devil: Fix CVE-2009-3994.


From: Leo Famulari
Subject: 01/01: gnu: devil: Fix CVE-2009-3994.
Date: Mon, 30 May 2016 16:37:24 +0000 (UTC)

lfam pushed a commit to branch master
in repository guix.

commit 726f0888849102b4ba4df6dd8738012c1d4c90d4
Author: Leo Famulari <address@hidden>
Date:   Mon May 30 12:30:49 2016 -0400

    gnu: devil: Fix CVE-2009-3994.
    
    * gnu/packages/patches/devil-CVE-2009-3994.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Add it.
    * gnu/packages/image.scm (devil): Use it.
---
 gnu/local.mk                                   |    1 +
 gnu/packages/image.scm                         |    3 ++-
 gnu/packages/patches/devil-CVE-2009-3994.patch |   24 ++++++++++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 6110d2d..5f10dd8 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -460,6 +460,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/cursynth-wave-rand.patch                        \
   %D%/packages/patches/dbus-helper-search-path.patch           \
   %D%/packages/patches/dealii-p4est-interface.patch            \
+  %D%/packages/patches/devil-CVE-2009-3994.patch               \
   %D%/packages/patches/devil-fix-libpng.patch                  \
   %D%/packages/patches/dico-libtool-deterministic.patch                \
   %D%/packages/patches/diffutils-gets-undeclared.patch         \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 3651e97..eca9012 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -693,7 +693,8 @@ channels.")
                 "1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8"))
               ;; Backported from upstream:
               ;; 
https://github.com/DentonW/DevIL/commit/724194d7a9a91221a564579f64bdd6f0abd64219.patch
-              (patches (search-patches "devil-fix-libpng.patch"))
+              (patches (search-patches "devil-fix-libpng.patch"
+                                       "devil-CVE-2009-3994.patch"))
               (modules '((guix build utils)))
               (snippet
                ;; Fix old lcms include directives and lib flags.
diff --git a/gnu/packages/patches/devil-CVE-2009-3994.patch 
b/gnu/packages/patches/devil-CVE-2009-3994.patch
new file mode 100644
index 0000000..e009a95
--- /dev/null
+++ b/gnu/packages/patches/devil-CVE-2009-3994.patch
@@ -0,0 +1,24 @@
+Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or
+arbitrary code execution via crafted DICOM file).
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994
+
+Copied from Fedora
+https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb
+
+diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c
+--- devil-1.7.8/src-IL/src/il_dicom.c~ 2009-03-08 08:10:09.000000000 +0100
++++ devil-1.7.8/src-IL/src/il_dicom.c  2009-12-03 12:07:45.000000000 +0100
+@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID)
+               return IL_FALSE;
+ 
+       ValLen = GetLittleUShort();
++      if (ValLen > 64)
++              return IL_FALSE;
+       if (iread(UID, ValLen, 1) != 1)
+               return IL_FALSE;
+-      UID[64] = 0;  // Just to make sure that our string is terminated.
++      UID[ValLen] = 0;  // Just to make sure that our string is terminated.
+ 
+       return IL_TRUE;
+ }



reply via email to

[Prev in Thread] Current Thread [Next in Thread]