diff options
| author | Kevin Daudt <kdaudt@alpinelinux.org> | 2021-11-21 18:01:48 +0000 |
|---|---|---|
| committer | Kevin Daudt <kdaudt@alpinelinux.org> | 2021-11-21 18:26:45 +0000 |
| commit | b91cd2669cad0f0f02299f124021c74e5d3825d9 (patch) | |
| tree | 5a3864b9cf401b53cebc2b84e595ae2880519221 /main | |
| parent | cdea0ce46620015a471ab51203a8e411f2023d29 (diff) | |
main/py3-pillow: mitigate CVE-2021-23437
See: #13051
Diffstat (limited to 'main')
| -rw-r--r-- | main/py-pillow/APKBUILD | 17 | ||||
| -rw-r--r-- | main/py-pillow/cve-2021-23437.patch | 40 |
2 files changed, 53 insertions, 4 deletions
diff --git a/main/py-pillow/APKBUILD b/main/py-pillow/APKBUILD index 065e6a9f92a..67886be098d 100644 --- a/main/py-pillow/APKBUILD +++ b/main/py-pillow/APKBUILD @@ -3,7 +3,7 @@ pkgname=py-pillow _pkgname=Pillow pkgver=6.2.1 -pkgrel=0 +pkgrel=2 pkgdesc="Python Imaging Library" url="https://python-pillow.org" arch="all" @@ -13,10 +13,16 @@ makedepends="python2-dev python3-dev py-setuptools freetype-dev jpeg-dev libwebp tiff-dev libpng-dev lcms2-dev libjpeg-turbo-dev zlib-dev" subpackages="py2-${pkgname#py-}:_py2 py3-${pkgname#py-}:_py3" source="https://files.pythonhosted.org/packages/source/${_pkgname:0:1}/$_pkgname/$_pkgname-$pkgver.tar.gz - py-pillow-fix-pytest-ver.patch" + py-pillow-fix-pytest-ver.patch + cve-2021-23437.patch + " builddir="$srcdir/$_pkgname-$pkgver" [ "$CARCH" = "s390x" ] && options="!check" +# secfixes: +# 6.2.1-r2: +# - CVE-2021-23437 + build() { cd "$builddir" # zlib resides in lib @@ -55,5 +61,8 @@ _py() { $python setup.py install --prefix=/usr --root="$subpkgdir" } -sha512sums="757bfdab2ba418195e96e696d2d111de3b38b6bafe4f6f94012f024f59c9bc8542fdab54f643eaf7b2867a9214db806e72eecbdd636bfceb55b47d3164f643ec Pillow-6.2.1.tar.gz -b33216541d7cdeb481d650b7cafeb44333244abbdab035ff5aa086c8dc9c5b2e1e9e294048f299f803d251c7a70ac4ea0a68ba28e7a9ced136287d61310708cf py-pillow-fix-pytest-ver.patch" +sha512sums=" +757bfdab2ba418195e96e696d2d111de3b38b6bafe4f6f94012f024f59c9bc8542fdab54f643eaf7b2867a9214db806e72eecbdd636bfceb55b47d3164f643ec Pillow-6.2.1.tar.gz +b33216541d7cdeb481d650b7cafeb44333244abbdab035ff5aa086c8dc9c5b2e1e9e294048f299f803d251c7a70ac4ea0a68ba28e7a9ced136287d61310708cf py-pillow-fix-pytest-ver.patch +0c991bf55bd2b73e1f5539f8c2110c47ef48029ff1a91710384d1612903850b1bbedeacef90359e738a02faacffd2e3a1d48d14a800681cd04f0f98c453b609b cve-2021-23437.patch +" diff --git a/main/py-pillow/cve-2021-23437.patch b/main/py-pillow/cve-2021-23437.patch new file mode 100644 index 00000000000..9933ed8ceda --- /dev/null +++ b/main/py-pillow/cve-2021-23437.patch @@ -0,0 +1,40 @@ +From 1dc6564eb7ee8f28fb16eeffaf3572f3e1d5aa29 Mon Sep 17 00:00:00 2001 +From: Hugo van Kemenade <hugovk@users.noreply.github.com> +Date: Mon, 23 Aug 2021 19:10:49 +0300 +Subject: [PATCH] Raise ValueError if color specifier is too long + +--- + Tests/test_imagecolor.py | 9 +++++++++ + src/PIL/ImageColor.py | 2 ++ + 2 files changed, 11 insertions(+) + +diff --git a/Tests/test_imagecolor.py b/Tests/test_imagecolor.py +index b5d69379655..dbe8b9e957b 100644 +--- a/Tests/test_imagecolor.py ++++ b/Tests/test_imagecolor.py +@@ -191,3 +191,12 @@ def test_rounding_errors(): + assert (255, 255) == ImageColor.getcolor("white", "LA") + assert (163, 33) == ImageColor.getcolor("rgba(0, 255, 115, 33)", "LA") + Image.new("LA", (1, 1), "white") ++ ++ ++def test_color_too_long(): ++ # Arrange ++ color_too_long = "hsl(" + "1" * 100 + ")" ++ ++ # Act / Assert ++ with pytest.raises(ValueError): ++ ImageColor.getrgb(color_too_long) +diff --git a/src/PIL/ImageColor.py b/src/PIL/ImageColor.py +index 51df4404039..25f92f2c732 100644 +--- a/src/PIL/ImageColor.py ++++ b/src/PIL/ImageColor.py +@@ -32,6 +32,8 @@ def getrgb(color): + :param color: A color string + :return: ``(red, green, blue[, alpha])`` + """ ++ if len(color) > 100: ++ raise ValueError("color specifier is too long") + color = color.lower() + + rgb = colormap.get(color, None) |