diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/image.scm | 5 | ||||
| -rw-r--r-- | gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 |
3 files changed, 2 insertions, 56 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 6f9b1b1019..f6d365847f 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -544,7 +544,6 @@ dist_patch_DATA = \ gnu/packages/patches/icu4c-CVE-2015-1270.patch \ gnu/packages/patches/icu4c-CVE-2015-4760.patch \ gnu/packages/patches/ilmbase-fix-tests.patch \ - gnu/packages/patches/imlib2-CVE-2016-4024.patch \ gnu/packages/patches/irrlicht-mesa-10.patch \ gnu/packages/patches/jasper-CVE-2007-2721.patch \ gnu/packages/patches/jasper-CVE-2008-3520.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index db64ea0c9b..669c360b96 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -459,7 +459,7 @@ compose, and analyze GIF images.") (define-public imlib2 (package (name "imlib2") - (version "1.4.8") + (version "1.4.9") (source (origin (method url-fetch) (uri (string-append @@ -467,8 +467,7 @@ compose, and analyze GIF images.") version ".tar.bz2")) (sha256 (base32 - "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9")) - (patches (search-patches "imlib2-CVE-2016-4024.patch")))) + "08809xxk2555yj6glixzw9a0x3x8cx55imd89kj3r0h152bn8a3x")))) (build-system gnu-build-system) (native-inputs `(("pkgconfig" ,pkg-config))) diff --git a/gnu/packages/patches/imlib2-CVE-2016-4024.patch b/gnu/packages/patches/imlib2-CVE-2016-4024.patch deleted file mode 100644 index c4f1f21b28..0000000000 --- a/gnu/packages/patches/imlib2-CVE-2016-4024.patch +++ /dev/null @@ -1,52 +0,0 @@ -Fix CVE-2016-4024 (integer overflow in lib/image.h). - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024 - -Upstream source: -https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227 - -From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001 -From: "Yuriy M. Kaminskiy" <yumkam@gmail.com> -Date: Wed, 6 Apr 2016 03:34:01 +0300 -Subject: Fix integer overflow resulting in insufficient heap allocation - -IMAGE_DIMENSIONS_OK ensures that image width and height are less then -46340, so that maximum number of pixels is ~2**31. - -Unfortunately, there are a lot of code that allocates image data with -something like - - malloc(w * h * sizeof(DATA32)); - -Obviously, on 32-bit machines this results in integer overflow, -insufficient heap allocation, with [massive] out-of-bounds heap -overwrite. -Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to -not exceed ULONG_MAX/sizeof(DATA32). - -Security implications: -*) for 32-bit machines: insufficient heap allocation and heap overwrite -in many image loaders, with escalation potential to remote code -execution; -*) for 64-bit machines: it seems, no impact. ---- - src/lib/image.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/lib/image.h b/src/lib/image.h -index e9eb678..5fae6ed 100644 ---- a/src/lib/image.h -+++ b/src/lib/image.h -@@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file, - - /* The maximum pixmap dimension is 65535. */ - /* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */ --#define X_MAX_DIM 46340 -+/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */ -+#define X_MAX_DIM 32767 - - #define IMAGE_DIMENSIONS_OK(w, h) \ - ( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) ) --- -cgit v0.12 - |