diff options
| author | Leo <thinkabit.ukim@gmail.com> | 2019-10-28 09:11:32 -0300 |
|---|---|---|
| committer | Kevin Daudt <kdaudt@alpinelinux.org> | 2019-10-29 11:25:46 +0000 |
| commit | 867138742023dde9397648e41743a9173432a7b2 (patch) | |
| tree | a5491b6bdf28349192443b96fed9bfa77f59f82c /main/file/CVE-2019-18218.patch | |
| parent | ceff67c5d40cc138ae037f8aff6b1e3c3d00deb9 (diff) | |
| download | aports-867138742023dde9397648e41743a9173432a7b2.tar.gz aports-867138742023dde9397648e41743a9173432a7b2.tar.bz2 aports-867138742023dde9397648e41743a9173432a7b2.tar.xz | |
main/file: fix CVE-2019-18218
ref #10911
Closes !887
Diffstat (limited to 'main/file/CVE-2019-18218.patch')
| -rw-r--r-- | main/file/CVE-2019-18218.patch | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/main/file/CVE-2019-18218.patch b/main/file/CVE-2019-18218.patch new file mode 100644 index 0000000000..e7eba44922 --- /dev/null +++ b/main/file/CVE-2019-18218.patch @@ -0,0 +1,40 @@ +Source: https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 + +diff --git a/src/cdf.c b/src/cdf.c +index 556a3ff..8bb0a6d 100644 +--- a/src/cdf.c ++++ b/src/cdf.c +@@ -1013,8 +1013,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + } + nelements = CDF_GETUINT32(q, 1); +- if (nelements == 0) { +- DPRINTF(("CDF_VECTOR with nelements == 0\n")); ++ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) { ++ DPRINTF(("CDF_VECTOR with nelements == %" ++ SIZE_T_FORMAT "u\n", nelements)); + goto out; + } + slen = 2; +@@ -1056,8 +1057,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, + goto out; + inp += nelem; + } +- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", +- nelements)); + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { +diff --git a/src/cdf.h b/src/cdf.h +index 2f7e554..0505666 100644 +--- a/src/cdf.h ++++ b/src/cdf.h +@@ -48,6 +48,7 @@ + typedef int32_t cdf_secid_t; + + #define CDF_LOOP_LIMIT 10000 ++#define CDF_ELEMENT_LIMIT 100000 + + #define CDF_SECID_NULL 0 + #define CDF_SECID_FREE -1 + |