| Message ID | 20210814204354.352402-1-fontaine.fabrice@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [1/1] package/gd: fix CVE-2021-38115 | expand |
On Sat, 14 Aug 2021 22:43:54 +0200 Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote: > read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) > through 2.3.2 allows remote attackers to cause a denial of service > (out-of-bounds read) via a crafted TGA file. > > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> > --- > ...-of-bands-in-reading-tga-header-file.patch | 29 +++++++++++++++++++ > package/gd/gd.mk | 3 ++ > 2 files changed, 32 insertions(+) > create mode 100644 package/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch Applied to master, thanks. Thomas
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes: > read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) > through 2.3.2 allows remote attackers to cause a denial of service > (out-of-bounds read) via a crafted TGA file. > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Committed to 2021.02.x and 2021.05.x, thanks.
diff --git a/package/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch b/package/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch new file mode 100644 index 0000000000..a42bfb402e --- /dev/null +++ b/package/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch @@ -0,0 +1,29 @@ +From 8b111b2b4a4842179be66db68d84dda91a246032 Mon Sep 17 00:00:00 2001 +From: maryam ebrahimzadeh <maryam.ebr@student.sharif.edu> +Date: Mon, 19 Jul 2021 10:07:13 +0430 +Subject: [PATCH] fix read out-of-bands in reading tga header file + +[Retrieved from: +https://github.com/libgd/libgd/commit/8b111b2b4a4842179be66db68d84dda91a246032] +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> +--- + src/gd_tga.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/gd_tga.c b/src/gd_tga.c +index cae9428da..286febb28 100644 +--- a/src/gd_tga.c ++++ b/src/gd_tga.c +@@ -191,7 +191,11 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga) + return -1; + } + +- gdGetBuf(tga->ident, tga->identsize, ctx); ++ ++ if (gdGetBuf(tga->ident, tga->identsize, ctx) != tga->identsize) { ++ gd_error("fail to read header ident"); ++ return -1; ++ } + } + + return 1; diff --git a/package/gd/gd.mk b/package/gd/gd.mk index 2df81e6d37..90f966c294 100644 --- a/package/gd/gd.mk +++ b/package/gd/gd.mk @@ -15,6 +15,9 @@ GD_CPE_ID_PRODUCT = libgd GD_CONF_OPTS = --without-x --disable-rpath --disable-werror GD_DEPENDENCIES = host-pkgconf +# 0001-fix-read-out-of-bands-in-reading-tga-header-file.patch +GD_IGNORE_CVES += CVE-2021-38115 + # gd forgets to link utilities with -pthread even though it uses # pthreads, causing linking errors with static linking ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> --- ...-of-bands-in-reading-tga-header-file.patch | 29 +++++++++++++++++++ package/gd/gd.mk | 3 ++ 2 files changed, 32 insertions(+) create mode 100644 package/gd/0001-fix-read-out-of-bands-in-reading-tga-header-file.patch