diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/image.scm | 3 | ||||
| -rw-r--r-- | gnu/packages/patches/devil-CVE-2009-3994.patch | 24 |
3 files changed, 27 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 6110d2d784..5f10dd86be 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -460,6 +460,7 @@ dist_patch_DATA = \ %D%/packages/patches/cursynth-wave-rand.patch \ %D%/packages/patches/dbus-helper-search-path.patch \ %D%/packages/patches/dealii-p4est-interface.patch \ + %D%/packages/patches/devil-CVE-2009-3994.patch \ %D%/packages/patches/devil-fix-libpng.patch \ %D%/packages/patches/dico-libtool-deterministic.patch \ %D%/packages/patches/diffutils-gets-undeclared.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 3651e97f3e..eca9012bf8 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -693,7 +693,8 @@ channels.") "1zd850nn7nvkkhasrv7kn17kzgslr5ry933v6db62s4lr0zzlbv8")) ;; Backported from upstream: ;; https://github.com/DentonW/DevIL/commit/724194d7a9a91221a564579f64bdd6f0abd64219.patch - (patches (search-patches "devil-fix-libpng.patch")) + (patches (search-patches "devil-fix-libpng.patch" + "devil-CVE-2009-3994.patch")) (modules '((guix build utils))) (snippet ;; Fix old lcms include directives and lib flags. diff --git a/gnu/packages/patches/devil-CVE-2009-3994.patch b/gnu/packages/patches/devil-CVE-2009-3994.patch new file mode 100644 index 0000000000..e009a95c44 --- /dev/null +++ b/gnu/packages/patches/devil-CVE-2009-3994.patch @@ -0,0 +1,24 @@ +Fix CVE-2009-3994 (buffer overflow in GetUID() allows remote DOS or +arbitrary code execution via crafted DICOM file). + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3994 + +Copied from Fedora +https://pkgs.fedoraproject.org/cgit/rpms/DevIL.git/tree/DevIL-1.7.8-CVE-2009-3994.patch?id=9c656a75393d6c455aef9f4968fbbee9c53f4fdb + +diff -up devil-1.7.8/src-IL/src/il_dicom.c~ devil-1.7.8/src-IL/src/il_dicom.c +--- devil-1.7.8/src-IL/src/il_dicom.c~ 2009-03-08 08:10:09.000000000 +0100 ++++ devil-1.7.8/src-IL/src/il_dicom.c 2009-12-03 12:07:45.000000000 +0100 +@@ -427,9 +427,11 @@ ILboolean GetUID(ILubyte *UID) + return IL_FALSE; + + ValLen = GetLittleUShort(); ++ if (ValLen > 64) ++ return IL_FALSE; + if (iread(UID, ValLen, 1) != 1) + return IL_FALSE; +- UID[64] = 0; // Just to make sure that our string is terminated. ++ UID[ValLen] = 0; // Just to make sure that our string is terminated. + + return IL_TRUE; + } |