Re: [Buildroot] [PATCH 1/3] package/giflib/0002-Fix-CVE-2022-28506.patch: New security patch

From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Adam Duskett <adam.duskett@amarulasolutions.com>
Cc: Bernd Kuhls <bernd@kuhls.net>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/3] package/giflib/0002-Fix-CVE-2022-28506.patch: New security patch
Date: Mon, 18 Dec 2023 17:45:20 +0100	[thread overview]
Message-ID: <ZYB3IOYkssfcdw7t@landeda> (raw)
In-Reply-To: <20231205235919.510051-2-adam.duskett@amarulasolutions.com>

Adam, All,

On 2023-12-05 16:59 -0700, Adam Duskett spake thusly:
> Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> ---
>  package/giflib/0002-Fix-CVE-2022-28506.patch | 34 ++++++++++++++++++++
>  1 file changed, 34 insertions(+)
>  create mode 100644 package/giflib/0002-Fix-CVE-2022-28506.patch
> 
> diff --git a/package/giflib/0002-Fix-CVE-2022-28506.patch b/package/giflib/0002-Fix-CVE-2022-28506.patch
> new file mode 100644
> index 0000000000..35d5f60a95
> --- /dev/null
> +++ b/package/giflib/0002-Fix-CVE-2022-28506.patch
> @@ -0,0 +1,34 @@
> +From c0cca041fc4fb6748d8dff3675fe7a839253d668 Mon Sep 17 00:00:00 2001
> +From: Sandro Mani <manisandro@gmail.com>
> +Date: Tue, 5 Dec 2023 16:24:32 -0700
> +Subject: [PATCH] Fix CVE-2022-28506

You forgot tadd GIFLIB_IGNORE_CVES = CVE-2022-28506

Applied to master with the above fixed, thanks.

Regards,
Yann E. MORIN.

> +From: giflib-5.2.1-17.fc39.src.rpm
> +Fixes https://nvd.nist.gov/vuln/detail/CVE-2022-28506
> +Upstream: https://sourceforge.net/p/giflib/bugs/159/
> +
> +Signed-off-by: Sandro Mani <manisandro@gmail.com>
> +Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> +---
> + gif2rgb.c | 5 +++++
> + 1 file changed, 5 insertions(+)
> +
> +diff --git a/gif2rgb.c b/gif2rgb.c
> +index 8d7c0ff..d9a469f 100644
> +--- a/gif2rgb.c
> ++++ b/gif2rgb.c
> +@@ -294,6 +294,11 @@ static void DumpScreen2RGB(char *FileName, int OneFileFlag,
> +             GifRow = ScreenBuffer[i];
> +             GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
> +             for (j = 0, BufferP = Buffer; j < ScreenWidth; j++) {
> ++                /* Check if color is within color palete */
> ++                if (GifRow[j] >= ColorMap->ColorCount)
> ++                {
> ++                   GIF_EXIT(GifErrorString(D_GIF_ERR_IMAGE_DEFECT));
> ++                }
> +                 ColorMapEntry = &ColorMap->Colors[GifRow[j]];
> +                 *BufferP++ = ColorMapEntry->Red;
> +                 *BufferP++ = ColorMapEntry->Green;
> +-- 
> +2.43.0
> +
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot