[oe-commits] [meta-openembedded] 02/43: gd : CVE-2016-10166

[git at git.openembedded.org]

This is an automated email from the git hooks/post-receive script.

martin_jansa pushed a commit to branch master
in repository meta-openembedded.

commit f882211c14507894248bb4ff064153b242d1d9d7
Author: Catalin Enache <catalin.enache at windriver.com>
AuthorDate: Thu Apr 6 14:08:36 2017 +0300

    gd : CVE-2016-10166
    
    Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c
    in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers
    to have unspecified impact via vectors related to decrementing the u variable.
    
    Reference:
    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10166
    
    Upstream patch:
    https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35
    
    Signed-off-by: Catalin Enache <catalin.enache at windriver.com>
    Signed-off-by: Martin Jansa <Martin.Jansa at gmail.com>
---
 meta-oe/recipes-support/gd/gd/CVE-2016-10166.patch | 60 ++++++++++++++++++++++
 meta-oe/recipes-support/gd/gd_2.2.3.bb             |  3 +-
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/meta-oe/recipes-support/gd/gd/CVE-2016-10166.patch b/meta-oe/recipes-support/gd/gd/CVE-2016-10166.patch
new file mode 100644
index 0000000..7ccfbea
--- /dev/null
+++ b/meta-oe/recipes-support/gd/gd/CVE-2016-10166.patch
@@ -0,0 +1,60 @@
+From c92240c1670c20c2f854761d3a89ab61dd158c91 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Sat, 6 Aug 2016 10:08:53 +0200
+Subject: [PATCH] Fix potential unsigned underflow
+
+No need to decrease `u`, so we don't do it. While we're at it, we also factor
+out the overflow check of the loop, what improves performance and readability.
+
+This issue has been reported by Stefan Esser to security at libgd.org.
+
+Upstream-Status: Backport
+CVE: CVE-2016-10166
+
+Signed-off-by: Catalin Enache <catalin.enache at windriver.com>
+---
+ src/gd_interpolation.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/src/gd_interpolation.c b/src/gd_interpolation.c
+index 7e7943d..9944349 100644
+--- a/src/gd_interpolation.c
++++ b/src/gd_interpolation.c
+@@ -829,8 +829,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
+ {
+ 	unsigned int u = 0;
+ 	LineContribType *res;
+-	int overflow_error = 0;
++	size_t weights_size;
+ 
++	if (overflow2(windows_size, sizeof(double))) {
++		return NULL;
++	} else {
++		weights_size = windows_size * sizeof(double);
++	}
+ 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
+ 	if (!res) {
+ 		return NULL;
+@@ -847,15 +852,11 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
+ 		return NULL;
+ 	}
+ 	for (u = 0 ; u < line_length ; u++) {
+-		if (overflow2(windows_size, sizeof(double))) {
+-			overflow_error = 1;
+-		} else {
+-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
+-		}
+-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
++		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
++		if (res->ContribRow[u].Weights == NULL) {
+ 			unsigned int i;
+-			u--;
+-			for (i=0;i<=u;i++) {
++
++			for (i=0;i<u;i++) {
+ 				gdFree(res->ContribRow[i].Weights);
+ 			}
+ 			gdFree(res->ContribRow);
+-- 
+2.10.2
+
diff --git a/meta-oe/recipes-support/gd/gd_2.2.3.bb b/meta-oe/recipes-support/gd/gd_2.2.3.bb
index c5aff66..4ff6b756 100644
--- a/meta-oe/recipes-support/gd/gd_2.2.3.bb
+++ b/meta-oe/recipes-support/gd/gd_2.2.3.bb
@@ -13,7 +13,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=c97638cafd3581eb87abd37332137669"
 DEPENDS = "freetype libpng jpeg zlib tiff"
 
 SRC_URI = "git://github.com/libgd/libgd.git;branch=GD-2.2 \
-           file://fix-gcc-unused-functions.patch"
+           file://fix-gcc-unused-functions.patch \
+           file://CVE-2016-10166.patch"
 
 SRCREV = "46ceef5970bf3a847ff61d1bdde7501d66c11d0c"
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.