aboutsummaryrefslogtreecommitdiff
path: root/package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch
diff options
context:
space:
mode:
authorGravatar Fabrice Fontaine <fontaine.fabrice@gmail.com>2020-07-31 09:51:36 +0200
committerGravatar Peter Korsgaard <peter@korsgaard.com>2020-08-03 23:06:56 +0200
commit6fa1a32dac3cb4ee03fd11bb965cd4b57d14e86a (patch)
tree8a2d753f4e0b5c9d618bcc795355d1d02f51d35d /package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch
parent654b5d934a7cdab7deca16b374322236de08d472 (diff)
downloadbuildroot-6fa1a32dac3cb4ee03fd11bb965cd4b57d14e86a.tar.gz
buildroot-6fa1a32dac3cb4ee03fd11bb965cd4b57d14e86a.tar.bz2
package/gd: fix CVE-2018-14553 and CVE-2019-6977
- Fix CVE-2018-14553 : gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. - Fix CVE-2019-6977: gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Diffstat (limited to 'package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch')
-rw-r--r--package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch44
1 files changed, 44 insertions, 0 deletions
diff --git a/package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch b/package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch
new file mode 100644
index 0000000000..8234de45a2
--- /dev/null
+++ b/package/gd/0005-Fix-potential-NULL-pointer-dereference-in-gdImageClone.patch
@@ -0,0 +1,44 @@
+From a93eac0e843148dc2d631c3ba80af17e9c8c860f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?F=C3=A1bio=20Cabral=20Pacheco?= <fcabralpacheco@gmail.com>
+Date: Fri, 20 Dec 2019 12:03:33 -0300
+Subject: [PATCH] Fix potential NULL pointer dereference in gdImageClone()
+
+[Retrieved (and updated to remove .gitignore and tests) from:
+https://github.com/libgd/libgd/commit/a93eac0e843148dc2d631c3ba80af17e9c8c860f]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ src/gd.c | 9 +--------
+ tests/gdimageclone/.gitignore | 1 +
+ tests/gdimageclone/CMakeLists.txt | 1 +
+ tests/gdimageclone/Makemodule.am | 3 ++-
+ tests/gdimageclone/style.c | 30 ++++++++++++++++++++++++++++++
+ 5 files changed, 35 insertions(+), 9 deletions(-)
+ create mode 100644 tests/gdimageclone/style.c
+
+diff --git a/src/gd.c b/src/gd.c
+index 592a0286..d564d1f9 100644
+--- a/src/gd.c
++++ b/src/gd.c
+@@ -2865,14 +2865,6 @@ BGD_DECLARE(gdImagePtr) gdImageClone (gdImagePtr src) {
+ }
+ }
+
+- if (src->styleLength > 0) {
+- dst->styleLength = src->styleLength;
+- dst->stylePos = src->stylePos;
+- for (i = 0; i < src->styleLength; i++) {
+- dst->style[i] = src->style[i];
+- }
+- }
+-
+ dst->interlace = src->interlace;
+
+ dst->alphaBlendingFlag = src->alphaBlendingFlag;
+@@ -2907,6 +2899,7 @@ BGD_DECLARE(gdImagePtr) gdImageClone (gdImagePtr src) {
+
+ if (src->style) {
+ gdImageSetStyle(dst, src->style, src->styleLength);
++ dst->stylePos = src->stylePos;
+ }
+
+ for (i = 0; i < gdMaxColors; i++) {