diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2017-02-10 17:40:25 +0100 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2017-02-10 17:40:25 +0100 |
| commit | 768f0ac9dd9993827430d62d0f72a5020f476892 (patch) | |
| tree | 600f7ca7cedb221147edfc92356e11bc6c56f311 /gnu/packages/patches/p7zip-CVE-2016-9296.patch | |
| parent | 955ba55c6bf3a22264b56274ec22cad1551c1ce6 (diff) | |
| parent | 49dbae548e92e0521ae125239282a04d8ea924cf (diff) | |
| download | gnu-guix-768f0ac9dd9993827430d62d0f72a5020f476892.tar gnu-guix-768f0ac9dd9993827430d62d0f72a5020f476892.tar.gz | |
Merge branch 'master' into core-updates
Diffstat (limited to 'gnu/packages/patches/p7zip-CVE-2016-9296.patch')
| -rw-r--r-- | gnu/packages/patches/p7zip-CVE-2016-9296.patch | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/gnu/packages/patches/p7zip-CVE-2016-9296.patch b/gnu/packages/patches/p7zip-CVE-2016-9296.patch new file mode 100644 index 0000000000..3fa80377ad --- /dev/null +++ b/gnu/packages/patches/p7zip-CVE-2016-9296.patch @@ -0,0 +1,24 @@ +From: Robert Luberda <robert@debian.org> +Date: Sat, 19 Nov 2016 08:48:08 +0100 +Subject: Fix nullptr dereference (CVE-2016-9296) + +Patch taken from https://sourceforge.net/p/p7zip/bugs/185/ +This patch file taken from Debian's patch set for p7zip +--- + CPP/7zip/Archive/7z/7zIn.cpp | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/CPP/7zip/Archive/7z/7zIn.cpp b/CPP/7zip/Archive/7z/7zIn.cpp +index b0c6b98..7c6dde2 100644 +--- a/CPP/7zip/Archive/7z/7zIn.cpp ++++ b/CPP/7zip/Archive/7z/7zIn.cpp +@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedStreams( + if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i]) + ThrowIncorrect(); + } +- HeadersSize += folders.PackPositions[folders.NumPackStreams]; ++ if (folders.PackPositions) ++ HeadersSize += folders.PackPositions[folders.NumPackStreams]; + return S_OK; + } + |