pool/libwpd
SHA256
8
0
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Add patch to fix rh#1643752 bsc#1115713 CVE-2018-19208:

Browse Source 
* 0001-Resolves-rhbz-1643752-bounds-check-m_currentTable-ac.patch

OBS-URL: https://build.opensuse.org/package/show/LibreOffice:Factory/libwpd?expand=0&rev=21
This commit is contained in:
Tomáš Chvátal
2018-11-13 09:13:43 +00:00
committed by Git OBS Bridge
parent e6a944ad22
commit aa4a2495b5
3 changed files with 45 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
0001-Resolves-rhbz-1643752-bounds-check-m_currentTable-ac.patch Normal file
View File

@@ -0,0 +1,29 @@
diff -ru libwpd-0.10.2/src/lib/WP6ContentListener.cpp libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp
--- libwpd-0.10.2/src/lib/WP6ContentListener.cpp 2017-09-08 18:04:25.000000000 +0100
+++ libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp 2018-10-30 10:54:22.326697162 +0000
@@ -1311,7 +1311,10 @@
m_ps->m_tableDefinition.m_columnsProperties.clear();
// pull a table definition off of our stack
- m_parseState->m_currentTable = m_parseState->m_tableList[m_parseState->m_nextTableIndice++];
+ auto index = m_parseState->m_nextTableIndice++;
+ if (index >= m_parseState->m_tableList.size())
+ throw ParseException();
+ m_parseState->m_currentTable = m_parseState->m_tableList[index];
if (!m_parseState->m_currentTable)
throw ParseException();
m_parseState->m_currentTable->makeBordersConsistent();
diff -ru libwpd-0.10.2/src/lib/WPXTable.h libwpd-0.10.2.new/src/lib/WPXTable.h
--- libwpd-0.10.2/src/lib/WPXTable.h 2015-12-30 08:27:30.000000000 +0000
+++ libwpd-0.10.2.new/src/lib/WPXTable.h 2018-10-30 10:55:41.264362182 +0000
@@ -92,6 +92,10 @@
{
m_tableList->push_back(table);
}
+ size_t size() const
+ {
+ return m_tableList->size();
+ }
private:
void release();

6
libwpd.changes
View File

@@ -1,3 +1,9 @@
-------------------------------------------------------------------
Tue Nov 13 09:07:55 UTC 2018 - Tomáš Chvátal <tchvatal@suse.com>
- Add patch to fix rh#1643752 bsc#1115713 CVE-2018-19208:
* 0001-Resolves-rhbz-1643752-bounds-check-m_currentTable-ac.patch
-------------------------------------------------------------------
Wed Sep 13 10:49:05 UTC 2017 - tchvatal@suse.com

23
libwpd.spec
View File

@@ -1,7 +1,7 @@
#
# spec file for package libwpd
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
@@ -21,10 +21,11 @@ Name: libwpd
Version: 0.10.2
Release: 0
Summary: Library for Importing WordPerfect (tm) Documents
License: LGPL-2.1+ AND MPL-2.0+
License: LGPL-2.1-or-later AND MPL-2.0+
Group: Productivity/Publishing/Word
Url: http://libwpd.sourceforge.net
URL: http://libwpd.sourceforge.net
Source: http://downloads.sourceforge.net/project/%{name}/%{name}/%{name}-%{version}/%{name}-%{version}.tar.xz
Patch0: 0001-Resolves-rhbz-1643752-bounds-check-m_currentTable-ac.patch
BuildRequires: doxygen
BuildRequires: fdupes
BuildRequires: gcc-c++
@@ -70,9 +71,7 @@ an in-process component.
%package devel-doc
Summary: Documentation for the libwpd API
Group: Documentation/Other
%if 0%{?suse_version} > 1200
BuildArch: noarch
%endif
%description devel-doc
This package contains documentation for the libwpd API.
@@ -87,6 +86,7 @@ supported: html, raw, text
%prep
%setup -q
%patch0 -p1
%build
export CXXFLAGS="%{optflags} -fvisibility-inlines-hidden"
@@ -110,6 +110,8 @@ done
%postun -n %{libname} -p /sbin/ldconfig
%files -n %{libname}
%license COPYING.LGPL
%license COPYING.MPL
%{_libdir}/*.so.*
%files devel
@@ -124,12 +126,7 @@ done
%files tools
%{_bindir}/*
%{_mandir}/man1/*.1*
%doc ChangeLog
%doc COPYING.LGPL
%doc COPYING.MPL
%doc CREDITS
%doc NEWS
%doc TODO
%{_mandir}/man1/*.1%{?ext_man}
%doc ChangeLog CREDITS NEWS
%changelog