forked from pool/libmirage
Jan Engelhardt
217c4be070
- Add 0001-libMirage-CSO-filter-validate-part-size.patch, 0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch [boo#1148087, CVE-2019-15540] OBS-URL: https://build.opensuse.org/package/show/filesystems/libmirage?expand=0&rev=53
39 lines
1.7 KiB
Diff
39 lines
1.7 KiB
Diff
From 0e9292c9aa34bf545f43f7efe5f0b94faba94962 Mon Sep 17 00:00:00 2001
|
|
From: Rok Mandeljc <rok.mandeljc@gmail.com>
|
|
Date: Sun, 25 Aug 2019 14:53:58 +0200
|
|
Subject: [PATCH 1/2] libMirage: CSO filter: validate part size
|
|
|
|
Part size must be always either smaller than the declared block
|
|
size (compressed block) or equal to it (raw block). If not, return
|
|
error - because we allocate our I/O buffer based on the block size.
|
|
|
|
Fixes SF bug #119, which is triggered by part size ending up being
|
|
larger than the block size. Thanks to Andrea Fioraldi for report
|
|
and thorough analysis of the issue.
|
|
---
|
|
libmirage/filters/filter-cso/filter-stream.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c
|
|
index 5f2f5e25..d43aa54a 100644
|
|
--- a/libmirage/filters/filter-cso/filter-stream.c
|
|
+++ b/libmirage/filters/filter-cso/filter-stream.c
|
|
@@ -120,6 +120,14 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self
|
|
CSO_Part *prev_part = &self->priv->parts[i-1];
|
|
|
|
prev_part->comp_size = cur_part->offset - prev_part->offset;
|
|
+
|
|
+ /* Part size must be either smaller than header->block_size
|
|
+ (compressed block ) or equal to it (raw block) */
|
|
+ if (prev_part->comp_size > header->block_size) {
|
|
+ MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: invalid part/index entry: part data length (%" G_GINT64_MODIFIER "d) exceeds declared block size (%d)!\n", __debug__, prev_part->comp_size, header->block_size);
|
|
+ g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!"));
|
|
+ return FALSE;
|
|
+ }
|
|
}
|
|
}
|
|
|
|
--
|
|
2.22.1
|
|
|