Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package autotrace for openSUSE:Factory checked in at 2022-05-19 22:49:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/autotrace (Old) and /work/SRC/openSUSE:Factory/.autotrace.new.1538 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "autotrace" Thu May 19 22:49:51 2022 rev:23 rq:978086 version:0.31.1 Changes: -------- --- /work/SRC/openSUSE:Factory/autotrace/autotrace.changes 2014-08-13 17:08:48.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.autotrace.new.1538/autotrace.changes 2022-05-19 22:50:25.434419779 +0200 @@ -1,0 +2,8 @@ +Fri May 13 16:01:02 UTC 2022 - Stanislav Brabec <[email protected]> + +- biWidth*biBitCnt integer overflow fix (bsc#1182158, + CVE-2019-19004, CVE-2019-19004.patch). +- Bitmap double free fix (bsc1182159, CVE-2019-19005, + CVE-2017-9182, CVE-2017-9190, CVE-2019-19005.patch). + +------------------------------------------------------------------- New: ---- CVE-2019-19004.patch CVE-2019-19005.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ autotrace.spec ++++++ --- /var/tmp/diff_new_pack.3ju2Ga/_old 2022-05-19 22:50:25.902420379 +0200 +++ /var/tmp/diff_new_pack.3ju2Ga/_new 2022-05-19 22:50:25.910420389 +0200 @@ -1,7 +1,7 @@ # # spec file for package autotrace # -# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2022 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # @@ -21,7 +21,7 @@ BuildRequires: libtool BuildRequires: pstoedit-devel Summary: Program for Converting Bitmaps to Vector Graphics -License: GPL-2.0+ and LGPL-2.1+ +License: GPL-2.0-or-later AND LGPL-2.1-or-later Group: Productivity/Graphics/Convertors Provides: bitmap_tracing Version: 0.31.1 @@ -29,9 +29,13 @@ Source: %{name}-%{version}.tar.bz2 Source1: pstoedit.m4 Patch0: %{name}-%{version}-quotefix.diff -# PATCH-FIX_OPENSUSE 0001-fix_input_png.patch [email protected] -- fixes build failure against libpng15 +# PATCH-FIX-OPENSUSE 0001-fix_input_png.patch [email protected] -- fixes build failure against libpng15 Patch1: 0001-fix_input_png.patch -Url: http://autotrace.sourceforge.net/ +# PATCH-FIX-SECURITY CVE-2019-19004.patch bsc1182158 CVE-2019-19004 -- biWidth*biBitCnt integer overflow fix +Patch2: CVE-2019-19004.patch +# PATCH-FIX-SECURITY CVE-2019-19005.patch bsc1182159 CVE-2019-19005 CVE-2017-9182, CVE-2017-9190 -- bitmap double free fix +Patch3: CVE-2019-19005.patch +URL: http://autotrace.sourceforge.net/ BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: ImageMagick-devel # FIXME: Broken with the latest pstoedit. See Fedora patches for partial fix. @@ -75,6 +79,8 @@ %setup -q %patch0 %patch1 -p1 +%patch2 -p1 +%patch3 -p1 %build export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -fno-tree-sra" ++++++ CVE-2019-19004.patch ++++++ >From 64c5833e55d7672d6136a3fbfeae24bd012d36a5 Mon Sep 17 00:00:00 2001 From: Matthew Pruett <[email protected]> Date: Sat, 6 Feb 2021 23:09:31 -0500 Subject: [PATCH] Check for overflow in row bytes Fixes CVE-2019-19004 --- src/input-bmp.c | 7 +++++++ 1 file changed, 7 insertions(+) Index: autotrace-0.31.1/input-bmp.c =================================================================== --- autotrace-0.31.1.orig/input-bmp.c +++ autotrace-0.31.1/input-bmp.c @@ -219,6 +219,13 @@ input_bmp_reader (at_string filename, /* Windows and OS/2 declare filler so that rows are a multiple of * word length (32 bits == 4 bytes) */ + + unsigned long overflowTest = Bitmap_Head.biWidth * Bitmap_Head.biBitCnt; + if (overflowTest / Bitmap_Head.biWidth != Bitmap_Head.biBitCnt) { + LOG("Error reading BMP file header. Width is too large\n"); + at_exception_fatal(&exp, "Error reading BMP file header. Width is too large"); + goto cleanup; + } rowbytes= ( (Bitmap_Head.biWidth * Bitmap_Head.biBitCnt - 1) / 32) * 4 + 4; ++++++ CVE-2019-19005.patch ++++++ >From 268aee495bf0efbd0a548c7318203123d3bfb598 Mon Sep 17 00:00:00 2001 From: Matthew Pruett <[email protected]> Date: Sat, 6 Feb 2021 23:25:09 -0500 Subject: [PATCH] Check for size 0 passed to malloc and calloc Handling of size 0 is implementation-defined and may lead to vulnerabilities based on implementation (https://wiki.sei.cmu.edu/confluence/display/c/MEM04-C.+Beware+of+zero-length+allocations). This fixes CVE-2017-9182 and CVE-2017-9190. --- src/xstd.h | 4 ++++ 1 file changed, 4 insertions(+) Index: autotrace-0.31.1/xstd.h =================================================================== --- autotrace-0.31.1.orig/xstd.h +++ autotrace-0.31.1/xstd.h @@ -20,6 +20,7 @@ #define XMALLOC(new_mem, size) \ do \ { \ + assert(size); \ new_mem = (at_address) malloc (size); \ assert(new_mem); \ } while (0) @@ -28,6 +29,7 @@ do \ #define XCALLOC(new_mem, size) \ do \ { \ + assert(size); \ new_mem = (at_address) calloc (size, 1); \ assert(new_mem); \ } while (0) @@ -55,6 +57,7 @@ do \ #define XMALLOC(new_mem, size) \ do \ { \ + assert(size); \ (at_address&)(new_mem) = (at_address) malloc (size); \ assert(new_mem); \ } while (0) @@ -63,6 +66,7 @@ do \ #define XCALLOC(new_mem, sizex) \ do \ { \ + assert(sizex); \ (at_address&)(new_mem) = (void *) calloc (sizex, 1); \ assert(new_mem); \ } while (0)
