Adam Majer
1d51fd3bc7
(timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) (CVE-2023-46809, bsc#1219997) * CVE-2024-22019.patch: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) (CVE-2024-22019, bsc#1219993) * CVE-2024-22025.patch: fix Denial of Service by resource exhaustion in fetch() brotli decoding (CVE-2024-22025, bsc#1220014) * CVE-2024-24806.patch: fix improper domain lookup that potentially leads to SSRF attacks (CVE-2024-24806, bsc#1220053) OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs14?expand=0&rev=111
27 lines
568 B
Diff
27 lines
568 B
Diff
Index: node-v16.20.2/deps/uv/src/idna.c
|
|
===================================================================
|
|
--- node-v16.20.2.orig/deps/uv/src/idna.c
|
|
+++ node-v16.20.2/deps/uv/src/idna.c
|
|
@@ -273,6 +273,9 @@ long uv__idna_toascii(const char* s, con
|
|
char* ds;
|
|
int rc;
|
|
|
|
+ if (s == se)
|
|
+ return UV_EINVAL;
|
|
+
|
|
ds = d;
|
|
|
|
si = s;
|
|
@@ -307,8 +310,9 @@ long uv__idna_toascii(const char* s, con
|
|
return rc;
|
|
}
|
|
|
|
- if (d < de)
|
|
- *d++ = '\0';
|
|
+ if (d >= de)
|
|
+ return UV_EINVAL;
|
|
|
|
+ *d++ = '\0';
|
|
return d - ds; /* Number of bytes written. */
|
|
}
|