wok-next view lcms/stuff/patches/lcms-1.19-cve_2013_4276-1.patch @ rev 20921
flake8 -> python-flake8
| author | Aleksej Bobylev <al.bobylev@gmail.com> |
|---|---|
| date | Wed Aug 22 11:18:36 2018 +0300 (2018-08-22) |
| parents | |
| children |
line source
1 Submitted By: Fernando de Oliveira <famobr at yahoo dot com dot br>
2 Date: 2015-03-24
3 Initial Package Version: 1.19
4 Upstream Status: unknown
5 Origin: Arch Linux
6 URL (CVE): https://www.suse.com/security/cve/CVE-2013-4276.html
7 Description: Multiple stack-based buffer overflows in LittleCMS
8 (aka lcms or liblcms) 1.19 and earlier allow remote
9 attackers to cause a denial of service (crash) via a
10 crafted (1) ICC color profile to the icctrans utility
11 or (2) TIFF image to the tiffdiff utility.
13 diff -ur lcms-1.19.dfsg/samples/icctrans.c lcms-1.19.dfsg-patched/samples/icctrans.c
14 --- lcms-1.19.dfsg/samples/icctrans.c 2009-10-30 15:57:45.000000000 +0000
15 +++ lcms-1.19.dfsg-patched/samples/icctrans.c 2013-08-06 11:53:14.385266647 +0100
16 @@ -86,6 +86,8 @@
17 static LPcmsNAMEDCOLORLIST InputColorant = NULL;
18 static LPcmsNAMEDCOLORLIST OutputColorant = NULL;
20 +unsigned int Buffer_size = 4096;
21 +
23 // isatty replacement
25 @@ -500,7 +502,7 @@
27 Prefix[0] = 0;
28 if (!lTerse)
29 - sprintf(Prefix, "%s=", C);
30 + snprintf(Prefix, 20, "%s=", C);
32 if (InHexa)
33 {
34 @@ -648,7 +650,9 @@
35 static
36 void GetLine(char* Buffer)
37 {
38 - scanf("%s", Buffer);
39 + char User_buffer[Buffer_size];
40 + fgets(User_buffer, (Buffer_size - 1), stdin);
41 + sscanf(User_buffer,"%s", Buffer);
43 if (toupper(Buffer[0]) == 'Q') { // Quit?
45 @@ -668,7 +672,7 @@
46 static
47 double GetAnswer(const char* Prompt, double Range)
48 {
49 - char Buffer[4096];
50 + char Buffer[Buffer_size];
51 double val = 0.0;
53 if (Range == 0.0) { // Range 0 means double value
54 @@ -738,7 +742,7 @@
55 static
56 WORD GetIndex(void)
57 {
58 - char Buffer[4096], Name[40], Prefix[40], Suffix[40];
59 + char Buffer[Buffer_size], Name[40], Prefix[40], Suffix[40];
60 int index, max;
62 max = cmsNamedColorCount(hTrans)-1;
63 diff -ur lcms-1.19.dfsg/tifficc/tiffdiff.c lcms-1.19.dfsg-patched/tifficc/tiffdiff.c
64 --- lcms-1.19.dfsg/tifficc/tiffdiff.c 2009-10-30 15:57:46.000000000 +0000
65 +++ lcms-1.19.dfsg-patched/tifficc/tiffdiff.c 2013-08-06 11:49:06.698951157 +0100
66 @@ -633,7 +633,7 @@
67 cmsIT8SetSheetType(hIT8, "TIFFDIFF");
70 - sprintf(Buffer, "Differences between %s and %s", TiffName1, TiffName2);
71 + snprintf(Buffer, 256, "Differences between %s and %s", TiffName1, TiffName2);
73 cmsIT8SetComment(hIT8, Buffer);