forked from pool/libXpm
Stefan Dirsch
1510a4ef3e
* needed by U_0005-Fix-CVE-2022-4883-compression-commands-depend-on-PAT.patch
- U_0002-Fix-CVE-2022-46285-Infinite-loop-on-unclosed-comment.patch
* libXpm: Infinite loop on unclosed comments (CVE-2022-46285,
bsc#1207029)
- U_0004-Fix-CVE-2022-44617-Runaway-loop-with-width-of-0-and-.patch
* libXpm: Runaway loop on width of 0 and enormous height
(CVE-2022-44617, bsc#1207030)
- U_0005-Fix-CVE-2022-4883-compression-commands-depend-on-PAT.patch
* libXpm: compression commands depend on $PATH (CVE-2022-4883,
bsc#1207031)
- U_regression-bug1207029_1207030_1207031.patch
* regression fix for above patches
- U_regression2-bug1207029_1207030_1207031.patch
* second regression fix: Use gzip -d instead of gunzip
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/libXpm?expand=0&rev=18
38 lines
1.1 KiB
Diff
38 lines
1.1 KiB
Diff
From 4636007dd4cebca8ee10738a7833f629d8687529 Mon Sep 17 00:00:00 2001
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Date: Sat, 17 Dec 2022 12:23:45 -0800
|
|
Subject: [PATCH libXpm 2/5] Fix CVE-2022-46285: Infinite loop on unclosed
|
|
comments
|
|
|
|
When reading XPM images from a file with libXpm 3.5.14 or older, if a
|
|
comment in the file is not closed (i.e. a C-style comment starts with
|
|
"/*" and is missing the closing "*/"), the ParseComment() function will
|
|
loop forever calling getc() to try to read the rest of the comment,
|
|
failing to notice that it has returned EOF, which may cause a denial of
|
|
service to the calling program.
|
|
|
|
Reported-by: Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
---
|
|
src/data.c | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/src/data.c b/src/data.c
|
|
index 898889c..bfad4ff 100644
|
|
--- a/src/data.c
|
|
+++ b/src/data.c
|
|
@@ -174,6 +174,10 @@ ParseComment(xpmData *data)
|
|
notend = 0;
|
|
Ungetc(data, *s, file);
|
|
}
|
|
+ else if (c == EOF) {
|
|
+ /* hit end of file before the end of the comment */
|
|
+ return XpmFileInvalid;
|
|
+ }
|
|
}
|
|
return 0;
|
|
}
|
|
--
|
|
2.15.2
|
|
|