forked from pool/netcdf
Egbert Eich
790b2ccff9
- Fix: * CVE-2019-20007 https://sourceforge.net/p/ezxml/bugs/13 * CVE-2019-20006 https://sourceforge.net/p/ezxml/bugs/15 * CVE-2019-20201 https://sourceforge.net/p/ezxml/bugs/16 * CVE-2019-20202 https://sourceforge.net/p/ezxml/bugs/17 * CVE-2019-20199 https://sourceforge.net/p/ezxml/bugs/18 * CVE-2019-20200 https://sourceforge.net/p/ezxml/bugs/19 * CVE-2019-20198 https://sourceforge.net/p/ezxml/bugs/20 * CVE-2021-26221 https://sourceforge.net/p/ezxml/bugs/21 * CVE-2021-26222 https://sourceforge.net/p/ezxml/bugs/22 * CVE-2021-30485 https://sourceforge.net/p/ezxml/bugs/25 * CVE-2021-31229 https://sourceforge.net/p/ezxml/bugs/26 * CVE-2021-31347 & * CVE-2021-31348 https://sourceforge.net/p/ezxml/bugs/27 * CVE-2021-31598 https://sourceforge.net/p/ezxml/bugs/28 (bsc#1191856) Note: * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23 not relevant for netcdf: code isn't used. * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14 Issue cannot be reproduced and no patch is available upstream. Added: * Fix-CVE-2021-30485-bug-25.patch * Fix-CVE-2021-31229-bug-26-CVE-2019-20201-bug-16-CVE-2019-20198-bug-20.patch * Fix-CVE-2021-31347-bug-27.patch * Fix-for-CVE-2019-20006-CVE-2019-20202-CVE-2021-31598-ezxml-bug-15-17-28.patch * Fix-for-CVE-2019-20007-ezxml-bug-13.patch * Fix-for-CVE-2019-20199-ezxml-bug-18.patch * Fix-for-CVE-2019-20200-ezxml-bug-19.patch * Fix-for-CVE-2021-26221-ezxml-bug-21.patch OBS-URL: https://build.opensuse.org/request/show/927323 OBS-URL: https://build.opensuse.org/package/show/science/netcdf?expand=0&rev=120
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From: Egbert Eich <eich@suse.com>
|
|
Date: Sat Jul 10 09:41:22 2021 +0200
|
|
Subject: parseServers(): Fix uninitialized variable simplify error path
|
|
Patch-mainline: Not yet
|
|
Git-repo: https://github.com/Unidata/netcdf-c
|
|
Git-commit: 06fbbbc78023abca48ae3a69aa409f7f0a4cf3a3
|
|
References:
|
|
|
|
When rtslen == 0 code jumped to 'done' where it checked for rts being
|
|
!= NULL. At this point, rts was not yet set.
|
|
Fixed code paths eliminating unneeded tests and jumps.
|
|
|
|
Signed-off-by: Egbert Eich <eich@suse.com>
|
|
Signed-off-by: Egbert Eich <eich@suse.de>
|
|
---
|
|
include/nctestserver.h | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
diff --git a/include/nctestserver.h b/include/nctestserver.h
|
|
index 978210c8..e7b63b80 100644
|
|
--- a/include/nctestserver.h
|
|
+++ b/include/nctestserver.h
|
|
@@ -47,7 +47,7 @@ parseServers(const char* remotetestservers)
|
|
size_t rtslen = strlen(remotetestservers);
|
|
|
|
/* Keep LGTM quiet */
|
|
- if(rtslen > MAXREMOTETESTSERVERS) goto done;
|
|
+ if(rtslen > MAXREMOTETESTSERVERS) return NULL;
|
|
list = (char**)malloc(sizeof(char*) * (int)(rtslen/2));
|
|
if(list == NULL) return NULL;
|
|
rts = strdup(remotetestservers);
|
|
@@ -65,8 +65,8 @@ parseServers(const char* remotetestservers)
|
|
*l = NULL;
|
|
servers = list;
|
|
list = NULL;
|
|
+ free(rts);
|
|
done:
|
|
- if(rts) free(rts);
|
|
if(list) free(list);
|
|
return servers;
|
|
}
|