diff options
| author | Li Wang <li.wang@windriver.com> | 2012-12-13 15:24:07 +0800 |
|---|---|---|
| committer | Saul Wold <sgw@linux.intel.com> | 2012-12-14 15:17:21 -0800 |
| commit | c82517bb667484854eaa05b6e9efd9ee0f164fec (patch) | |
| tree | 2fd7f6a2b1b2a8970e00e8c81530b6d2a30b2224 /meta | |
| parent | 0742b7aecaada435f90f39f26914906a5eb1fd4f (diff) | |
| download | openembedded-core-c82517bb667484854eaa05b6e9efd9ee0f164fec.tar.gz openembedded-core-c82517bb667484854eaa05b6e9efd9ee0f164fec.tar.bz2 openembedded-core-c82517bb667484854eaa05b6e9efd9ee0f164fec.zip | |
cups CVE-2011-3170
the patch come from:
http://cups.org/strfiles/3914/str3914.patch
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and
earlier does not properly handle the first code word in an LZW stream,
which allows remote attackers to trigger a heap-based buffer overflow,
and possibly execute arbitrary code, via a crafted stream, a different
vulnerability than CVE-2011-2896.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170
[YOCTO #3583]
[ CQID: WIND00299594 ]
Upstream-Status: Backport
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Diffstat (limited to 'meta')
| -rw-r--r-- | meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch | 54 | ||||
| -rw-r--r-- | meta/recipes-extended/cups/cups_1.4.6.bb | 3 |
2 files changed, 56 insertions, 1 deletions
diff --git a/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch new file mode 100644 index 0000000000..fd1b95847c --- /dev/null +++ b/meta/recipes-extended/cups/cups-1.4.6/cups-CVE-2011-3170.patch @@ -0,0 +1,54 @@ +cups CVE-2011-3170 + +the patch come from: +http://cups.org/strfiles/3914/str3914.patch + +The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and +earlier does not properly handle the first code word in an LZW stream, +which allows remote attackers to trigger a heap-based buffer overflow, +and possibly execute arbitrary code, via a crafted stream, a different +vulnerability than CVE-2011-2896. +http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3170 + +Integrated-by: Li Wang <li.wang@windriver.com> +--- + filter/image-gif.c | 14 +++++++++----- + 1 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/filter/image-gif.c b/filter/image-gif.c +index 9542704..3857c21 100644 +--- a/filter/image-gif.c ++++ b/filter/image-gif.c +@@ -654,11 +654,13 @@ gif_read_lzw(FILE *fp, /* I - File to read from */ + + if (code >= max_code) + { +- *sp++ = firstcode; +- code = oldcode; ++ if (sp < (stack + 8192)) ++ *sp++ = firstcode; ++ ++ code = oldcode; + } + +- while (code >= clear_code) ++ while (code >= clear_code && sp < (stack + 8192)) + { + *sp++ = table[1][code]; + if (code == table[0][code]) +@@ -667,8 +669,10 @@ gif_read_lzw(FILE *fp, /* I - File to read from */ + code = table[0][code]; + } + +- *sp++ = firstcode = table[1][code]; +- code = max_code; ++ if (sp < (stack + 8192)) ++ *sp++ = firstcode = table[1][code]; ++ ++ code = max_code; + + if (code < 4096) + { +-- +1.7.0.5 + diff --git a/meta/recipes-extended/cups/cups_1.4.6.bb b/meta/recipes-extended/cups/cups_1.4.6.bb index 7cecd7fc82..75c23d39e6 100644 --- a/meta/recipes-extended/cups/cups_1.4.6.bb +++ b/meta/recipes-extended/cups/cups_1.4.6.bb @@ -1,6 +1,6 @@ require cups14.inc -PR = "r8" +PR = "r9" DEPENDS += "libusb \ ${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" @@ -10,6 +10,7 @@ SRC_URI += " \ file://0001-don-t-try-to-run-generated-binaries.patch \ file://cups_serverbin.patch \ file://cups-CVE-2011-2896.patch \ + file://cups-CVE-2011-3170.patch \ file://cups-CVE-2012-5519.patch \ " |