diff options
| author | Mark H Weaver <mhw@netris.org> | 2015-09-19 21:35:18 -0400 |
|---|---|---|
| committer | Mark H Weaver <mhw@netris.org> | 2015-09-19 21:35:18 -0400 |
| commit | 65d54af49f31a808a8481f34a95887eba4c8bb57 (patch) | |
| tree | 5df23cb55a5f6dc1206b2c1b0709603726b3d67a /gnu/packages/patches | |
| parent | 257abebba3c11b957d9d994dcaf5894a0410f807 (diff) | |
| download | gnu-guix-65d54af49f31a808a8481f34a95887eba4c8bb57.tar gnu-guix-65d54af49f31a808a8481f34a95887eba4c8bb57.tar.gz | |
gnu: icu4c: Add fixes for CVE-2014-6585 and CVE-2015-1270.
* gnu/packages/patches/icu4c-CVE-2014-6585.patch,
gnu/packages/patches/icu4c-CVE-2015-1270.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/icu4c.scm (icu4c)[source]: Add patches.
Diffstat (limited to 'gnu/packages/patches')
| -rw-r--r-- | gnu/packages/patches/icu4c-CVE-2014-6585.patch | 21 | ||||
| -rw-r--r-- | gnu/packages/patches/icu4c-CVE-2015-1270.patch | 15 |
2 files changed, 36 insertions, 0 deletions
diff --git a/gnu/packages/patches/icu4c-CVE-2014-6585.patch b/gnu/packages/patches/icu4c-CVE-2014-6585.patch new file mode 100644 index 0000000000..d21a0d0ba1 --- /dev/null +++ b/gnu/packages/patches/icu4c-CVE-2014-6585.patch @@ -0,0 +1,21 @@ +Copied from Debian. + +description: out-of-bounds read +origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6585 + +--- a/source/layout/LETableReference.h ++++ b/source/layout/LETableReference.h +@@ -322,7 +322,12 @@ LE_TRACE_TR("INFO: new RTAO") + } + + const T& operator()(le_uint32 i, LEErrorCode &success) const { +- return *getAlias(i,success); ++ const T *ret = getAlias(i,success); ++ if (LE_FAILURE(success) || ret==NULL) { ++ return *(new T()); ++ } else { ++ return *ret; ++ } + } + + size_t getOffsetFor(le_uint32 i, LEErrorCode &success) const { diff --git a/gnu/packages/patches/icu4c-CVE-2015-1270.patch b/gnu/packages/patches/icu4c-CVE-2015-1270.patch new file mode 100644 index 0000000000..2a7658d36e --- /dev/null +++ b/gnu/packages/patches/icu4c-CVE-2015-1270.patch @@ -0,0 +1,15 @@ +Copied from Debian. + +diff --git a/source/common/ucnv_io.cpp b/source/common/ucnv_io.cpp +index 5dd35d8..4424664 100644 +--- a/source/common/ucnv_io.cpp ++++ b/source/common/ucnv_io.cpp +@@ -744,7 +744,7 @@ ucnv_io_getConverterName(const char *alias, UBool *containsOption, UErrorCode *p + * the name begins with 'x-'. If it does, strip it off and try + * again. This behaviour is similar to how ICU4J does it. + */ +- if (aliasTmp[0] == 'x' || aliasTmp[1] == '-') { ++ if (aliasTmp[0] == 'x' && aliasTmp[1] == '-') { + aliasTmp = aliasTmp+2; + } else { + break; |