From patchwork Sun Nov 8 17:11:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bernd Kuhls X-Patchwork-Id: 1396345 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=busybox.net (client-ip=140.211.166.138; helo=whitealder.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=t-online.de Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4CTgf706kYz9sRR for ; Mon, 9 Nov 2020 04:11:59 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id AE9DE8683A; Sun, 8 Nov 2020 17:11:55 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dkmKY0XZY6Pi; Sun, 8 Nov 2020 17:11:53 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id E9CDD8675E; Sun, 8 Nov 2020 17:11:52 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by ash.osuosl.org (Postfix) with ESMTP id 085F61BF479 for ; Sun, 8 Nov 2020 17:11:51 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id DDF7C203EF for ; Sun, 8 Nov 2020 17:11:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hQqqPiUP4jZm for ; Sun, 8 Nov 2020 17:11:48 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mailout03.t-online.de (mailout03.t-online.de [194.25.134.81]) by silver.osuosl.org (Postfix) with ESMTPS id 800DE2010B for ; Sun, 8 Nov 2020 17:11:48 +0000 (UTC) Received: from fwd28.aul.t-online.de (fwd28.aul.t-online.de [172.20.26.133]) by mailout03.t-online.de (Postfix) with SMTP id 69C37420AC0A for ; Sun, 8 Nov 2020 18:11:45 +0100 (CET) Received: from fli4l.lan.fli4l (rSdKb0ZEZhODtVbYEnpyRvsnZfiyEWvzKTZS28vkaQghQb800B5Wiqm5WlZCNrGgeg@[79.214.203.187]) by fwd28.t-online.de with (TLSv1:ECDHE-RSA-AES256-SHA encrypted) esmtp id 1kboEB-0UlpJo0; Sun, 8 Nov 2020 18:11:43 +0100 Received: from mahler.lan.fli4l ([192.168.1.1]:46602) by fli4l.lan.fli4l with esmtp (Exim 4.94) (envelope-from ) id 1kboEA-00052e-Qi for buildroot@buildroot.org; Sun, 08 Nov 2020 18:11:43 +0100 From: Bernd Kuhls To: buildroot@buildroot.org Date: Sun, 8 Nov 2020 18:11:41 +0100 Message-Id: <20201108171142.1286536-1-bernd.kuhls@t-online.de> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-ID: rSdKb0ZEZhODtVbYEnpyRvsnZfiyEWvzKTZS28vkaQghQb800B5Wiqm5WlZCNrGgeg X-TOI-EXPURGATEID: 150726::1604855503-00000C65-CE5AD54A/0/0 CLEAN NORMAL X-TOI-MSGID: 9f4a5f46-ca2f-4743-b857-7353a97583e3 Subject: [Buildroot] [PATCH 1/2] package/libexif: add security fix for CVE-2020-0198 X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Signed-off-by: Bernd Kuhls --- ...ed-another-unsigned-integer-overflow.patch | 63 +++++++++++++++++++ package/libexif/libexif.mk | 2 + 2 files changed, 65 insertions(+) create mode 100644 package/libexif/0001-fixed-another-unsigned-integer-overflow.patch diff --git a/package/libexif/0001-fixed-another-unsigned-integer-overflow.patch b/package/libexif/0001-fixed-another-unsigned-integer-overflow.patch new file mode 100644 index 0000000000..77bdfe89d2 --- /dev/null +++ b/package/libexif/0001-fixed-another-unsigned-integer-overflow.patch @@ -0,0 +1,63 @@ +From ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Mon, 8 Jun 2020 17:27:06 +0200 +Subject: [PATCH] fixed another unsigned integer overflow + +first fixed by google in android fork, +https://android.googlesource.com/platform/external/libexif/+/1e187b62682ffab5003c702657d6d725b4278f16%5E%21/#F0 + +(use a more generic overflow check method, also check second overflow instance.) + +https://security-tracker.debian.org/tracker/CVE-2020-0198 + +Downloaded from upstream commit: +https://github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c + +Signed-off-by: Bernd Kuhls +--- + libexif/exif-data.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/libexif/exif-data.c b/libexif/exif-data.c +index 8b280d3..b495726 100644 +--- a/libexif/exif-data.c ++++ b/libexif/exif-data.c +@@ -47,6 +47,8 @@ + #undef JPEG_MARKER_APP1 + #define JPEG_MARKER_APP1 0xe1 + ++#define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) ++ + static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00}; + + struct _ExifDataPrivate +@@ -327,7 +329,7 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); + return; + } +- if (s > ds - o) { ++ if (CHECKOVERFLOW(o,ds,s)) { + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); + return; + } +@@ -420,9 +422,9 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + } + + /* Read the number of entries */ +- if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) { ++ if (CHECKOVERFLOW(offset, ds, 2)) { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", +- "Tag data past end of buffer (%u > %u)", offset+2, ds); ++ "Tag data past end of buffer (%u+2 > %u)", offset, ds); + return; + } + n = exif_get_short (d + offset, data->priv->order); +@@ -431,7 +433,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + offset += 2; + + /* Check if we have enough data. */ +- if (offset + 12 * n > ds) { ++ if (CHECKOVERFLOW(offset, ds, 12*n)) { + n = (ds - offset) / 12; + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", + "Short data; only loading %hu entries...", n); diff --git a/package/libexif/libexif.mk b/package/libexif/libexif.mk index c945c275a7..979d592447 100644 --- a/package/libexif/libexif.mk +++ b/package/libexif/libexif.mk @@ -12,5 +12,7 @@ LIBEXIF_INSTALL_STAGING = YES LIBEXIF_DEPENDENCIES = host-pkgconf LIBEXIF_LICENSE = LGPL-2.1+ LIBEXIF_LICENSE_FILES = COPYING +# 0001-fixed-another-unsigned-integer-overflow.patch +LIBEXIF_IGNORE_CVES += CVE-2020-0198 $(eval $(autotools-package))