aboutsummaryrefslogtreecommitdiffstats
path: root/main/file/CVE-2019-18218.patch
diff options
context:
space:
mode:
authorLeo <thinkabit.ukim@gmail.com>2019-10-28 09:11:32 -0300
committerKevin Daudt <kdaudt@alpinelinux.org>2019-10-29 05:45:35 +0000
commit33bd61f256dd1826d6a7df5ebb8a9e2fc1125ce1 (patch)
tree91568fb48986574ed9d0007a1c05840b67e540da /main/file/CVE-2019-18218.patch
parent2c2f9f27c8ac931989d3a5975e6f7356494150f0 (diff)
downloadaports-33bd61f256dd1826d6a7df5ebb8a9e2fc1125ce1.tar.gz
aports-33bd61f256dd1826d6a7df5ebb8a9e2fc1125ce1.tar.bz2
aports-33bd61f256dd1826d6a7df5ebb8a9e2fc1125ce1.tar.xz
main/file: fix CVE-2019-18218
ref #10911 Closes !888
Diffstat (limited to 'main/file/CVE-2019-18218.patch')
-rw-r--r--main/file/CVE-2019-18218.patch40
1 files changed, 40 insertions, 0 deletions
diff --git a/main/file/CVE-2019-18218.patch b/main/file/CVE-2019-18218.patch
new file mode 100644
index 0000000000..e7eba44922
--- /dev/null
+++ b/main/file/CVE-2019-18218.patch
@@ -0,0 +1,40 @@
+Source: https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
+
+diff --git a/src/cdf.c b/src/cdf.c
+index 556a3ff..8bb0a6d 100644
+--- a/src/cdf.c
++++ b/src/cdf.c
+@@ -1013,8 +1013,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+ goto out;
+ }
+ nelements = CDF_GETUINT32(q, 1);
+- if (nelements == 0) {
+- DPRINTF(("CDF_VECTOR with nelements == 0\n"));
++ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
++ DPRINTF(("CDF_VECTOR with nelements == %"
++ SIZE_T_FORMAT "u\n", nelements));
+ goto out;
+ }
+ slen = 2;
+@@ -1056,8 +1057,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+ goto out;
+ inp += nelem;
+ }
+- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+- nelements));
+ for (j = 0; j < nelements && i < sh.sh_properties;
+ j++, i++)
+ {
+diff --git a/src/cdf.h b/src/cdf.h
+index 2f7e554..0505666 100644
+--- a/src/cdf.h
++++ b/src/cdf.h
+@@ -48,6 +48,7 @@
+ typedef int32_t cdf_secid_t;
+
+ #define CDF_LOOP_LIMIT 10000
++#define CDF_ELEMENT_LIMIT 100000
+
+ #define CDF_SECID_NULL 0
+ #define CDF_SECID_FREE -1
+