wok-next annotate arj/stuff/patches/CVE-2015-2782-buffer-overflow.patch @ rev 19715
Fix building: pciutils, pcmanfm-legacy, arj
author | Aleksej Bobylev <al.bobylev@gmail.com> |
---|---|
date | Sat May 13 17:25:31 2017 +0300 (2017-05-13) |
parents | |
children |
rev | line source |
---|---|
al@19715 | 1 Description: Fix buffer overflow causing an invalid pointer free(). |
al@19715 | 2 Author: Guillem Jover <guillem@debian.org> |
al@19715 | 3 Origin: vendor |
al@19715 | 4 Bug-Debian: https://bugs.debian.org/774015 |
al@19715 | 5 Forwarded: no |
al@19715 | 6 Last-Update: 2015-02-26 |
al@19715 | 7 |
al@19715 | 8 --- |
al@19715 | 9 decode.c | 6 +++--- |
al@19715 | 10 1 file changed, 3 insertions(+), 3 deletions(-) |
al@19715 | 11 |
al@19715 | 12 --- a/decode.c |
al@19715 | 13 +++ b/decode.c |
al@19715 | 14 @@ -255,7 +255,7 @@ void read_pt_len(int nn, int nbit, int i |
al@19715 | 15 if(i==i_special) |
al@19715 | 16 { |
al@19715 | 17 c=getbits(2); |
al@19715 | 18 - while(--c>=0) |
al@19715 | 19 + while(--c>=0&&i<nn) |
al@19715 | 20 pt_len[i++]=0; |
al@19715 | 21 } |
al@19715 | 22 } |
al@19715 | 23 @@ -314,10 +314,10 @@ void read_c_len() |
al@19715 | 24 c=getbits(CBIT); |
al@19715 | 25 c+=20; |
al@19715 | 26 } |
al@19715 | 27 - while(--c>=0) |
al@19715 | 28 + while(--c>=0&&i<NC) |
al@19715 | 29 c_len[i++]=0; |
al@19715 | 30 } |
al@19715 | 31 - else |
al@19715 | 32 + else if (i<NC) |
al@19715 | 33 c_len[i++]=(unsigned char)(c-2); |
al@19715 | 34 } |
al@19715 | 35 while(i<NC) |