forked from pool/libredwg
Jan Engelhardt
998b8e2de5
0001-fix-obj_flush_hdlstream-GH-497.patch [CVE-2022-35164] [boo#1202553] OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libredwg?expand=0&rev=35
46 lines
2.0 KiB
Diff
46 lines
2.0 KiB
Diff
From 2f36577e6ef6a32c81be48a6faac303f76f6f943 Mon Sep 17 00:00:00 2001
|
|
From: Reini Urban <rurban@cpan.org>
|
|
Date: Mon, 15 Aug 2022 11:06:14 +0200
|
|
Subject: [PATCH] fix obj_flush_hdlstream GH #497
|
|
|
|
don't free non-temp hdl_dat chain, when it's the dat->chain really.
|
|
(on old DWG's)
|
|
---
|
|
src/encode.c | 11 +++++++++--
|
|
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/encode.c b/src/encode.c
|
|
index d4a63e16..1b82dd2a 100644
|
|
--- a/src/encode.c
|
|
+++ b/src/encode.c
|
|
@@ -823,9 +823,11 @@ const unsigned char unknown_section[53]
|
|
bit_chain_init_dat (&dat2, 12, dat); \
|
|
hdl_dat = &dat2; \
|
|
ENCODE_COMMON_HANDLES \
|
|
+ bit_set_position (hdl_dat, 0); \
|
|
obj_flush_hdlstream (obj, dat, hdl_dat); /* common */ \
|
|
obj_flush_hdlstream (obj, dat, &dat1); /* special accumulated */ \
|
|
- bit_chain_free (&dat1); \
|
|
+ if (dat1.chain != dat->chain) \
|
|
+ bit_chain_free (&dat1); \
|
|
bit_chain_free (&dat2); \
|
|
*hdl_dat = *dat; \
|
|
hdl_dat = dat; \
|
|
@@ -855,7 +857,12 @@ obj_flush_hdlstream (Dwg_Object *restrict obj, Bit_Chain *restrict dat,
|
|
hdl_dat->byte, hdl_dat->bit, (datpos - objpos) / 8,
|
|
(datpos - objpos) % 8);
|
|
if (hdlpos > 10000U)
|
|
- LOG_ERROR("Possible hdl_data overflow")
|
|
+ LOG_WARN("Possible hdl_data overflow")
|
|
+ if (dat->chain == hdl_dat->chain)
|
|
+ {
|
|
+ LOG_WARN("Ignore identical hdl chains")
|
|
+ return;
|
|
+ }
|
|
// This might change dat->chain
|
|
bit_copy_chain (dat, hdl_dat);
|
|
}
|
|
--
|
|
2.37.1
|
|
|