diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/image.scm | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/optipng-CVE-2017-1000229.patch | 22 |
3 files changed, 24 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 5ea975c4f4..19db3c44ca 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -940,6 +940,7 @@ dist_patch_DATA = \ %D%/packages/patches/openssl-runpath.patch \ %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch \ %D%/packages/patches/openssl-c-rehash-in.patch \ + %D%/packages/patches/optipng-CVE-2017-1000229.patch \ %D%/packages/patches/orpheus-cast-errors-and-includes.patch \ %D%/packages/patches/osip-CVE-2017-7853.patch \ %D%/packages/patches/ots-no-include-missing-file.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 0e1f025563..b9f1ef2344 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -1095,6 +1095,7 @@ installed as @code{stb_image}.") (method url-fetch) (uri (string-append "http://prdownloads.sourceforge.net/optipng/optipng-" version ".tar.gz")) + (patches (search-patches "optipng-CVE-2017-1000229.patch")) (sha256 (base32 "105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28")))) diff --git a/gnu/packages/patches/optipng-CVE-2017-1000229.patch b/gnu/packages/patches/optipng-CVE-2017-1000229.patch new file mode 100644 index 0000000000..2cb3b2f21c --- /dev/null +++ b/gnu/packages/patches/optipng-CVE-2017-1000229.patch @@ -0,0 +1,22 @@ +Fix CVE-2017-1000229: + +https://security-tracker.debian.org/tracker/CVE-2017-1000229 +https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html +https://nvd.nist.gov/vuln/detail/CVE-2017-1000229 + +Patch copied from upstream bug tracker: +https://sourceforge.net/p/optipng/bugs/65/ + +diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c +index b4910ec..5f9b376 100644 +--- a/src/minitiff/tiffread.c ++++ b/src/minitiff/tiffread.c +@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp) + count = tiff_ptr->strip_offsets_count; + if (count == 0 || count > tiff_ptr->height) + goto err_invalid; ++ if (count > (size_t)-1 / sizeof(long)) ++ goto err_memory; + tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long)); + if (tiff_ptr->strip_offsets == NULL) + goto err_memory; |