Changeset View
Changeset View
Standalone View
Standalone View
files/security/cve-2017-13722.patch
- This file was added.
| From 672bb944311392e2415b39c0d63b1e1902905bcd Mon Sep 17 00:00:00 2001 | |||||
| From: Michal Srb <msrb@suse.com> | |||||
| Date: Thu, 20 Jul 2017 17:05:23 +0200 | |||||
| Subject: pcfGetProperties: Check string boundaries (CVE-2017-13722) | |||||
| Without the checks a malformed PCF file can cause the library to make | |||||
| atom from random heap memory that was behind the `strings` buffer. | |||||
| This may crash the process or leak information. | |||||
| Signed-off-by: Julien Cristau <jcristau@debian.org> | |||||
| diff --git a/src/bitmap/pcfread.c b/src/bitmap/pcfread.c | |||||
| index dab1c44..ae34c28 100644 | |||||
| --- a/src/bitmap/pcfread.c | |||||
| +++ b/src/bitmap/pcfread.c | |||||
| @@ -45,6 +45,7 @@ from The Open Group. | |||||
| #include <stdarg.h> | |||||
| #include <stdint.h> | |||||
| +#include <string.h> | |||||
| void | |||||
| pcfError(const char* message, ...) | |||||
| @@ -311,11 +312,19 @@ pcfGetProperties(FontInfoPtr pFontInfo, FontFilePtr file, | |||||
| if (IS_EOF(file)) goto Bail; | |||||
| position += string_size; | |||||
| for (i = 0; i < nprops; i++) { | |||||
| + if (props[i].name >= string_size) { | |||||
| + pcfError("pcfGetProperties(): String starts out of bounds (%ld/%d)\n", props[i].name, string_size); | |||||
| + goto Bail; | |||||
| + } | |||||
| props[i].name = MakeAtom(strings + props[i].name, | |||||
| - strlen(strings + props[i].name), TRUE); | |||||
| + strnlen(strings + props[i].name, string_size - props[i].name), TRUE); | |||||
| if (isStringProp[i]) { | |||||
| + if (props[i].value >= string_size) { | |||||
| + pcfError("pcfGetProperties(): String starts out of bounds (%ld/%d)\n", props[i].value, string_size); | |||||
| + goto Bail; | |||||
| + } | |||||
| props[i].value = MakeAtom(strings + props[i].value, | |||||
| - strlen(strings + props[i].value), TRUE); | |||||
| + strnlen(strings + props[i].value, string_size - props[i].value), TRUE); | |||||
| } | |||||
| } | |||||
| free(strings); | |||||
| -- | |||||
| cgit v0.10.2 | |||||
Copyright © 2015-2021 Solus Project. The Solus logo is Copyright © 2016-2021 Solus Project. All Rights Reserved.