Re: [Buildroot] [PATCH 2/3] package/giflib/0003-Fix-CVE-2023-39742.patch: New security patch

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Adam, All,

On 2023-12-05 16:59 -0700, Adam Duskett spake thusly:
> Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> ---
>  package/giflib/0003-Fix-CVE-2023-39742.patch | 36 ++++++++++++++++++++
>  1 file changed, 36 insertions(+)
>  create mode 100644 package/giflib/0003-Fix-CVE-2023-39742.patch
> 
> diff --git a/package/giflib/0003-Fix-CVE-2023-39742.patch b/package/giflib/0003-Fix-CVE-2023-39742.patch
> new file mode 100644
> index 0000000000..2ba01ac8a4
> --- /dev/null
> +++ b/package/giflib/0003-Fix-CVE-2023-39742.patch
> @@ -0,0 +1,36 @@
> +From 4288b993ee9df6550a367fe06ede3c003dc7bbc6 Mon Sep 17 00:00:00 2001
> +From: Sandro Mani <manisandro@gmail.com>
> +Date: Tue, 5 Dec 2023 16:35:40 -0700
> +Subject: [PATCH] Fix CVE-2023-39742

You forgot to add GIFLIB_IGNORE_CVES += CVE-2023-39742

Applied to master with the above fixed, thanks.

Regards,
Yann E. MORIN.

> +From: giflib-5.2.1-17.fc39.src.rpm
> +Fix segmentation faults due to non correct checking for args
> +Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-39742
> +Upstream: https://sourceforge.net/p/giflib/bugs/166/
> +
> +Signed-off-by: Sandro Mani <manisandro@gmail.com>
> +Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
> +---
> + getarg.c | 6 ++++++
> + 1 file changed, 6 insertions(+)
> +
> +diff --git a/getarg.c b/getarg.c
> +index d569f6c..51fbe0b 100644
> +--- a/getarg.c
> ++++ b/getarg.c
> +@@ -307,6 +307,12 @@ GAGetParmeters(void *Parameters[],
> +     int i = 0, ScanRes;
> + 
> +     while (!(ISSPACE(CtrlStrCopy[i]))) {
> ++
> ++        if ((*argv) == argv_end) {
> ++            GAErrorToken = Option;
> ++            return CMD_ERR_NumRead;
> ++        }
> ++
> +         switch (CtrlStrCopy[i + 1]) {
> +           case 'd':    /* Get signed integers. */
> +               ScanRes = sscanf(*((*argv)++), "%d",
> +-- 
> +2.43.0
> +
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot