From 348c14c7421c7d8fcdc82fd7014fb75eed11f56f Mon Sep 17 00:00:00 2001 From: Leonardo Arena Date: Tue, 6 Nov 2018 15:54:09 +0000 Subject: main/lcms2: security fix (CVE-2018-16435) Fixes #9443 --- main/lcms2/APKBUILD | 13 +++- main/lcms2/CVE-2018-16435.patch | 169 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 178 insertions(+), 4 deletions(-) create mode 100644 main/lcms2/CVE-2018-16435.patch diff --git a/main/lcms2/APKBUILD b/main/lcms2/APKBUILD index f3189b8796b..36ed15661ad 100644 --- a/main/lcms2/APKBUILD +++ b/main/lcms2/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Natanael Copa pkgname=lcms2 pkgver=2.9 -pkgrel=0 +pkgrel=1 pkgdesc="Color Management Engine" url="http://www.littlecms.com" arch="all" @@ -12,11 +12,15 @@ depends_dev="libjpeg-turbo-dev tiff-dev zlib-dev" makedepends="$depends_dev" install="" subpackages="$pkgname-dev $pkgname-doc $pkgname-utils" -source="http://www.littlecms.com/$pkgname-$pkgver.tar.gz" +source="http://www.littlecms.com/$pkgname-$pkgver.tar.gz + CVE-2018-16435.patch + " # secfixes: +# 2.9-r1: +# - CVE-2018-16435 # 2.8-r1: -# - CVE-2016-10165 +# - CVE-2016-10165 build() { cd "$builddir" @@ -52,4 +56,5 @@ utils() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="70b1c51fa8d137d5072425e580745ff1fbf49c6e8bb1da0a8adb0647d3b7c095208793cb02de1e8d1a01363b8575fa60c61bedbff99bbec57a44228239cb00e5 lcms2-2.9.tar.gz" +sha512sums="70b1c51fa8d137d5072425e580745ff1fbf49c6e8bb1da0a8adb0647d3b7c095208793cb02de1e8d1a01363b8575fa60c61bedbff99bbec57a44228239cb00e5 lcms2-2.9.tar.gz +9f2b0c72b7be0747fcdc71391bea1d1579a7b7ae7b6e8ac861f9faa603b4415e8cdd3c183bdeed444387bc618c16a028d74813a3d0040d70a0f474db2c90d832 CVE-2018-16435.patch" diff --git a/main/lcms2/CVE-2018-16435.patch b/main/lcms2/CVE-2018-16435.patch new file mode 100644 index 00000000000..775225c9884 --- /dev/null +++ b/main/lcms2/CVE-2018-16435.patch @@ -0,0 +1,169 @@ +From 768f70ca405cd3159d990e962d54456773bb8cf8 Mon Sep 17 00:00:00 2001 +From: Marti Maria +Date: Wed, 15 Aug 2018 20:07:56 +0200 +Subject: [PATCH] Upgrade Visual studio 2017 15.8 + +- Upgrade to 15.8 +- Add check on CGATS memory allocation (thanks to Quang Nguyen for +pointing out this) +--- + Projects/VC2017/jpegicc/jpegicc.vcxproj | 1 + + Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj | 2 +- + Projects/VC2017/lcms2_static/lcms2_static.vcxproj | 2 +- + Projects/VC2017/linkicc/linkicc.vcxproj | 2 +- + Projects/VC2017/psicc/psicc.vcxproj | 2 +- + Projects/VC2017/testbed/testbed.vcxproj | 2 +- + Projects/VC2017/tiffdiff/tiffdiff.vcxproj | 2 +- + Projects/VC2017/tifficc/tifficc.vcxproj | 2 +- + Projects/VC2017/transicc/transicc.vcxproj | 1 + + src/cmscgats.c | 14 ++++++++++---- + 10 files changed, 19 insertions(+), 11 deletions(-) + +diff --git a/Projects/VC2017/jpegicc/jpegicc.vcxproj b/Projects/VC2017/jpegicc/jpegicc.vcxproj +index ab26a53..39cfd00 100644 +--- a/Projects/VC2017/jpegicc/jpegicc.vcxproj ++++ b/Projects/VC2017/jpegicc/jpegicc.vcxproj +@@ -22,6 +22,7 @@ + {62812507-F926-4968-96A9-17678460AD90} + jpegicc + Win32Proj ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj +index 4c8aa3f..d1bf3eb 100644 +--- a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj ++++ b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj +@@ -22,7 +22,7 @@ + {8C51BE48-ADB8-4089-A9EC-F6BF993A0548} + lcms2_DLL + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj +index 2a9988a..9fc05ce 100644 +--- a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj ++++ b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj +@@ -22,7 +22,7 @@ + {71DEDE59-3F1E-486B-A899-4283000F76B5} + lcms2_static + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/linkicc/linkicc.vcxproj b/Projects/VC2017/linkicc/linkicc.vcxproj +index 30c2b4e..51586dd 100644 +--- a/Projects/VC2017/linkicc/linkicc.vcxproj ++++ b/Projects/VC2017/linkicc/linkicc.vcxproj +@@ -22,7 +22,7 @@ + {FBFBE1DC-DB84-4BA1-9552-B4780F457849} + linkicc + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/psicc/psicc.vcxproj b/Projects/VC2017/psicc/psicc.vcxproj +index 9dcf89a..8f26e12 100644 +--- a/Projects/VC2017/psicc/psicc.vcxproj ++++ b/Projects/VC2017/psicc/psicc.vcxproj +@@ -22,7 +22,7 @@ + {EF6A8851-65FE-46F5-B9EF-14F0B671F693} + psicc + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/testbed/testbed.vcxproj b/Projects/VC2017/testbed/testbed.vcxproj +index 0af3762..3f6aea3 100644 +--- a/Projects/VC2017/testbed/testbed.vcxproj ++++ b/Projects/VC2017/testbed/testbed.vcxproj +@@ -22,7 +22,7 @@ + {928A3A2B-46EF-4279-959C-513B3652FF0E} + testbed + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj +index 7edfe28..3a6d837 100644 +--- a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj ++++ b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj +@@ -22,7 +22,7 @@ + {75B91835-CCD7-48BE-A606-A9C997D5DBEE} + tiffdiff + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/tifficc/tifficc.vcxproj b/Projects/VC2017/tifficc/tifficc.vcxproj +index cd9f04c..5ef954f 100644 +--- a/Projects/VC2017/tifficc/tifficc.vcxproj ++++ b/Projects/VC2017/tifficc/tifficc.vcxproj +@@ -22,7 +22,7 @@ + {2256DE16-ED92-4A6F-9C54-F65BB61E64A2} + tifficc + Win32Proj +- 8.1 ++ 10.0.17134.0 + + + +diff --git a/Projects/VC2017/transicc/transicc.vcxproj b/Projects/VC2017/transicc/transicc.vcxproj +index d9b77c6..b3173d8 100644 +--- a/Projects/VC2017/transicc/transicc.vcxproj ++++ b/Projects/VC2017/transicc/transicc.vcxproj +@@ -22,6 +22,7 @@ + {9EE22D66-C849-474C-9ED5-C3E141DAB160} + transicc + Win32Proj ++ 10.0.17134.0 + + + +diff --git a/src/cmscgats.c b/src/cmscgats.c +index 1a87613..8c3e96d 100644 +--- a/src/cmscgats.c ++++ b/src/cmscgats.c +@@ -1,7 +1,7 @@ + //--------------------------------------------------------------------------------- + // + // Little Color Management System +-// Copyright (c) 1998-2017 Marti Maria Saguer ++// Copyright (c) 1998-2018 Marti Maria Saguer + // + // Permission is hereby granted, free of charge, to any person obtaining + // a copy of this software and associated documentation files (the "Software"), +@@ -1506,10 +1506,16 @@ void AllocateDataSet(cmsIT8* it8) + t-> nSamples = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS")); + t-> nPatches = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS")); + +- t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*)); +- if (t->Data == NULL) { ++ if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe) ++ { ++ SynError(it8, "AllocateDataSet: too much data"); ++ } ++ else { ++ t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*)); ++ if (t->Data == NULL) { + +- SynError(it8, "AllocateDataSet: Unable to allocate data array"); ++ SynError(it8, "AllocateDataSet: Unable to allocate data array"); ++ } + } + + } -- cgit v1.2.3