Hi Jan Thanks for applying the patch to address CVE-2016-6318.
Note though that there is still a second issue, and as noted by Daniel Lange it was as well applied in SuSE. I verfied that with that patch as well no heap-overflow is triggered anymore. Could you please as well apply it? I can otherwise do a NMU. Regards, Salvatore
The input word is guaranteed to be at most STRINGSIZE-1 in length. One of the
mangle operations involves duplicating the input word, resulting in a string
twice the length to be accommodated by both area variables.
Howard Guo <h...@suse.com> 2016-08-17
diff -rupN 3/lib/rules.c 3-patched/lib/rules.c
--- 3/lib/rules.c 2016-08-16 14:16:24.033261876 +0200
+++ 3-patched/lib/rules.c 2016-08-17 13:57:14.485782894 +0200
@@ -434,9 +434,8 @@ Mangle(input, control) /* returns a poi
{
int limit;
register char *ptr;
- static char area[STRINGSIZE];
- char area2[STRINGSIZE];
- area[0] = '\0';
+ static char area[STRINGSIZE * 2] = {0};
+ char area2[STRINGSIZE * 2] = {0};
strcpy(area, input);
for (ptr = control; *ptr; ptr++)
signature.asc
Description: PGP signature
