SHA256
8
0
forked from pool/netcdf
Files
netcdf/NCZ_def_var_chunking-make-sure-cs-is-set-before-used.patch

30 lines
912 B
Diff
Raw Permalink Normal View History

Accepting request 927323 from home:eeich:branches:science - Fix: * CVE-2019-20007 https://sourceforge.net/p/ezxml/bugs/13 * CVE-2019-20006 https://sourceforge.net/p/ezxml/bugs/15 * CVE-2019-20201 https://sourceforge.net/p/ezxml/bugs/16 * CVE-2019-20202 https://sourceforge.net/p/ezxml/bugs/17 * CVE-2019-20199 https://sourceforge.net/p/ezxml/bugs/18 * CVE-2019-20200 https://sourceforge.net/p/ezxml/bugs/19 * CVE-2019-20198 https://sourceforge.net/p/ezxml/bugs/20 * CVE-2021-26221 https://sourceforge.net/p/ezxml/bugs/21 * CVE-2021-26222 https://sourceforge.net/p/ezxml/bugs/22 * CVE-2021-30485 https://sourceforge.net/p/ezxml/bugs/25 * CVE-2021-31229 https://sourceforge.net/p/ezxml/bugs/26 * CVE-2021-31347 & * CVE-2021-31348 https://sourceforge.net/p/ezxml/bugs/27 * CVE-2021-31598 https://sourceforge.net/p/ezxml/bugs/28 (bsc#1191856) Note: * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23 not relevant for netcdf: code isn't used. * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14 Issue cannot be reproduced and no patch is available upstream. Added: * Fix-CVE-2021-30485-bug-25.patch * Fix-CVE-2021-31229-bug-26-CVE-2019-20201-bug-16-CVE-2019-20198-bug-20.patch * Fix-CVE-2021-31347-bug-27.patch * Fix-for-CVE-2019-20006-CVE-2019-20202-CVE-2021-31598-ezxml-bug-15-17-28.patch * Fix-for-CVE-2019-20007-ezxml-bug-13.patch * Fix-for-CVE-2019-20199-ezxml-bug-18.patch * Fix-for-CVE-2019-20200-ezxml-bug-19.patch * Fix-for-CVE-2021-26221-ezxml-bug-21.patch OBS-URL: https://build.opensuse.org/request/show/927323 OBS-URL: https://build.opensuse.org/package/show/science/netcdf?expand=0&rev=120
2021-10-25 17:34:01 +00:00
From: Egbert Eich <eich@suse.com>
Date: Mon Jul 12 11:57:24 2021 +0200
Subject: NCZ_def_var_chunking(): make sure 'cs' is set before used
Patch-mainline: Not yet
Git-repo: https://github.com/Unidata/netcdf-c
Git-commit: 47584171d90e03b9ddad94cbc7edf1ab20f9d468
References:
'cs' was only set when 'var->ndim' != 0. Thus cs could have been
uninitialized when ncz_dev_var_extra() was called.
Signed-off-by: Egbert Eich <eich@suse.com>
Signed-off-by: Egbert Eich <eich@suse.de>
---
libnczarr/zvar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libnczarr/zvar.c b/libnczarr/zvar.c
index 28ab00fb..d9e6af5b 100644
--- a/libnczarr/zvar.c
+++ b/libnczarr/zvar.c
@@ -865,7 +865,7 @@ int
ncz_def_var_chunking_ints(int ncid, int varid, int contiguous, int *chunksizesp)
{
NC_VAR_INFO_T *var;
- size_t *cs;
+ size_t *cs = NULL;
int i, retval;
/* Get pointer to the var. */