diff options
| author | Julien Lepiller <julien@lepiller.eu> | 2017-08-03 20:14:56 +0200 |
|---|---|---|
| committer | Julien Lepiller <julien@lepiller.eu> | 2017-08-04 18:58:33 +0200 |
| commit | 1cec3462323717e063c98b6404e9c5c5ef037bdd (patch) | |
| tree | fc9ef5f405f5397cb3546ee359de7a6b7e3b47fc /gnu/packages/patches | |
| parent | 8d6c845d68211005a873811f0aa2dbc369bddbb5 (diff) | |
| download | guix-1cec3462323717e063c98b6404e9c5c5ef037bdd.tar guix-1cec3462323717e063c98b6404e9c5c5ef037bdd.tar.gz | |
gnu: php: Update to 7.1.8.
* gnu/packages/patches/gd-CVE-2017-7890.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it
* gnu/packages/php.scm (php): Update to 7.1.8.
Diffstat (limited to 'gnu/packages/patches')
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2017-7890.patch | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/gnu/packages/patches/gd-CVE-2017-7890.patch b/gnu/packages/patches/gd-CVE-2017-7890.patch new file mode 100644 index 0000000000..66034c5703 --- /dev/null +++ b/gnu/packages/patches/gd-CVE-2017-7890.patch @@ -0,0 +1,30 @@ +From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001 +From: LEPILLER Julien <julien@lepiller.eu> +Date: Thu, 3 Aug 2017 17:04:17 +0200 +Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory. + +The stack allocated color map buffers were not zeroed before usage, and +so undefined palette indexes could cause information leakage. + +This is CVE-2017-7890. +--- + src/gd_gif_in.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c +index 008d1ec..c195448 100644 +--- a/src/gd_gif_in.c ++++ b/src/gd_gif_in.c +@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd) + + gdImagePtr im = 0; + ++ memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE); ++ memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE); ++ + if(!ReadOK(fd, buf, 6)) { + return 0; + } +-- +2.13.3 + |