Package: release.debian.org Severity: normal Tags: buster User: [email protected] Usertags: pu
I prepared an update for fig2dev 1:3.2.7a-5+deb10u3 to deb10u4, which in the first time fixes CVE-2021-3561 (the security team doesn't intend to create a DSA but redirected me here). Additionally it fixes four other buffer overflows, that are all fixed upstream and I backported the fixes. Last I added a mechanism, that rebuilds the testsuite (used at build time as well as in autopkgtest) to activate the tests that are added by the above patches. The salsa pipeline succeeded on this: https://salsa.debian.org/debian/fig2dev/-/pipelines/256545 A diff against 3.2.7a-5+deb10u3 is attached. Greetings Roland -- System Information: Debian Release: 10.9 APT prefers stable APT policy: (500, 'stable'), (50, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-16-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.utf-8, LC_CTYPE=de_DE.utf-8 (charmap=UTF-8), LANGUAGE=de_DE:de:en_GB:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
diff -Nru fig2dev-3.2.7a/debian/changelog fig2dev-3.2.7a/debian/changelog --- fig2dev-3.2.7a/debian/changelog 2020-01-07 19:53:09.000000000 +0100 +++ fig2dev-3.2.7a/debian/changelog 2021-05-22 11:20:55.000000000 +0200 @@ -1,3 +1,16 @@ +fig2dev (1:3.2.7a-5+deb10u4) buster; urgency=medium + + * 44_CVE-2021-3561: Fix buffer overflow color definitions. This fixes + CVE-2021-3561. + * Rename gitlab.yml to salsa.yml to activate pipeline again. + * 45_polyline2polygon: Convert polygons having too few points to polylines. + * 46_arrow-poly: Remove arrows from polygon with single point. + * 47_trunc-subsuper: Allow truncated sub/superscripts in text. + * 48_arrow-point: Omit arrows without points in svg output. + * Rebuild testsuite during build and in autopkgtest. + + -- Roland Rosenfeld <[email protected]> Sat, 22 May 2021 11:20:55 +0200 + fig2dev (1:3.2.7a-5+deb10u3) buster; urgency=medium * 42_CVE-2019-19746: Reject huge arrow types causing integer overflow. diff -Nru fig2dev-3.2.7a/debian/gitlab-ci.yml fig2dev-3.2.7a/debian/gitlab-ci.yml --- fig2dev-3.2.7a/debian/gitlab-ci.yml 2020-01-07 19:53:09.000000000 +0100 +++ fig2dev-3.2.7a/debian/gitlab-ci.yml 1970-01-01 01:00:00.000000000 +0100 @@ -1,7 +0,0 @@ ---- -include: - - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml - - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml - -variables: - RELEASE: 'buster' diff -Nru fig2dev-3.2.7a/debian/patches/44_CVE-2021-3561.patch fig2dev-3.2.7a/debian/patches/44_CVE-2021-3561.patch --- fig2dev-3.2.7a/debian/patches/44_CVE-2021-3561.patch 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/44_CVE-2021-3561.patch 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,61 @@ +From: Thomas Loimer <[email protected]> +Date: Sun Apr 25 00:49:15 2021 +0200 +Bug: https://sourceforge.net/p/mcj/tickets/116/ +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fig2dev/+bug/1926677 +Applied-Upstream: https://sourceforge.net/p/mcj/fig2dev/ci/6827c09d2d6491cb2ae3ac7196439ff3aa791fd9/ +Subject: Sanitize color definitions, ticket #116 (CVE-2021-3561) + +--- a/fig2dev/read.c ++++ b/fig2dev/read.c +@@ -539,30 +539,37 @@ read_colordef(char *line, int line_no) + + if (num_usr_cols >= MAX_USR_COLS) { + if (num_usr_cols == MAX_USR_COLS) { +- put_msg("Maximum number of color definitions (%d) exceeded at line %d.", ++ put_msg("Maximum number of color definitions (%d) " ++ "exceeded at line %d.", + MAX_USR_COLS, line_no); + ++num_usr_cols; + } + /* ignore additional colors */ + return; + } +- if (sscanf(line, "%*d %d #%2x%2x%2x", &c, &r, &g, &b) != 4) { +- if (c >= NUM_STD_COLS && c < NUM_STD_COLS + MAX_USR_COLS) { +- put_msg("Invalid color definition at line %d: %s, setting to black (#00000).", +- line_no, line); +- r = g = b = 0; +- } else { +- put_msg("User color number at line %d out of range (%d), should be between %d and %d.", ++ if (sscanf(line, "%*d %d #%2x%2x%2x", &c, &r, &g, &b) == 4) { ++ if (c >= NUM_STD_COLS && c < NUM_STD_COLS + MAX_USR_COLS && ++ r >=0 && r < 256 && g >=0 && g < 256 && ++ b >= 0 && b < 256 ) { ++ user_col_indx[num_usr_cols] = c; ++ user_colors[num_usr_cols].r = r; ++ user_colors[num_usr_cols].g = g; ++ user_colors[num_usr_cols].b = b; ++ ++num_usr_cols; ++ } else if (c < NUM_STD_COLS || c >= NUM_STD_COLS+MAX_USR_COLS) { ++ put_msg("User color number at line %d out of range (%d)" ++ ", should be between %d and %d.", + line_no, c, NUM_STD_COLS, + NUM_STD_COLS + MAX_USR_COLS - 1); +- return; ++ } else { ++ put_msg("Invalid color definition at line %d: %s, color" ++ " values must be between 0 through 255.", ++ line_no, line); + } ++ } else { ++ put_msg("Invalid color definition at line %d: %s.", ++ line_no, line); + } +- user_col_indx[num_usr_cols] = c; +- user_colors[num_usr_cols].r = r; +- user_colors[num_usr_cols].g = g; +- user_colors[num_usr_cols].b = b; +- ++num_usr_cols; + } + + static void diff -Nru fig2dev-3.2.7a/debian/patches/45_polygon2polyline.patch fig2dev-3.2.7a/debian/patches/45_polygon2polyline.patch --- fig2dev-3.2.7a/debian/patches/45_polygon2polyline.patch 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/45_polygon2polyline.patch 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,62 @@ +From: Thomas Loimer <[email protected]> +Date: Wed Dec 11 21:36:46 2019 +0100 +Bug: https://sourceforge.net/p/mcj/tickets/56/ +Applied-Upstream: https://sourceforge.net/p/mcj/fig2dev/ci/c379fe50574e5b5dd6e17f15d8473c5713d1b823/ +Subject: Convert polygons with too few points to polylines + + As a side effect, this also fixes ticket #56. + +--- a/fig2dev/read.c ++++ b/fig2dev/read.c +@@ -877,8 +877,10 @@ read_ellipseobject(char *line, int line_ + /* + * Sanitize line objects. Return 0 on success, -1 otherwise. + * On error, call free_linestorage(l) after sanitize_lineobject(). ++ * + * polylines: remove fill, if less than 3 points + * remove arrows, if only one point ++ * polygons: convert to polyline if less than 3 unique points + * rectangles, polygons: last point must coincide with first point + * rectangle: convert to polygon, if not 5 points + * rectangle with rounded corners: error, if not 5 points +@@ -939,6 +941,20 @@ sanitize_lineobject( + q->y = l->points->y; + } + ++ if (l->type == T_POLYGON) { ++ int npts; ++ ++ q = l->points; ++ for (npts = 1; q->next && npts < 4; q = q->next) ++ ++npts; ++ if (npts < 4 ) { ++ put_msg("A polygon with %d points at line %d - convert to a polyline.", ++ npts, line_no); ++ l->type = T_POLYLINE; ++ return 0; ++ } ++ } ++ + if (l->type == T_BOX || l->type == T_ARC_BOX || l->type == T_PIC_BOX) { + int npts = 1; + for (q = l->points; q->next; q = q->next) +--- a/fig2dev/tests/read.at ++++ b/fig2dev/tests/read.at +@@ -135,6 +135,17 @@ A single point with a backward arrow - r + ]) + AT_CLEANUP + ++AT_SETUP([convert short polygon to polyline, ticket #56]) ++AT_KEYWORDS(read.c polygon) ++AT_CHECK([fig2dev -L ptk <<EOF ++FIG_FILE_TOP ++2 3 0 1 -1 -1 50 -1 -1 0.0 0 0 -1 0 0 1 ++ 0 0 ++EOF ++], 0, ignore, [A polygon with 1 points at line 11 - convert to a polyline. ++]) ++AT_CLEANUP ++ + AT_SETUP([reject negative font type]) + AT_KEYWORDS(read.c font) + AT_CHECK([fig2dev -L box <<EOF diff -Nru fig2dev-3.2.7a/debian/patches/46_arroy-poly.patch fig2dev-3.2.7a/debian/patches/46_arroy-poly.patch --- fig2dev-3.2.7a/debian/patches/46_arroy-poly.patch 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/46_arroy-poly.patch 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,61 @@ +From: Thomas Loimer <[email protected]> +Date: Fri Apr 23 22:31:27 2021 +0200 +Bug: https://sourceforge.net/p/mcj/tickets/114/ +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fig2dev/+bug/1926673 +Applied-Upstream: https://sourceforge.net/p/mcj/fig2dev/ci/43cfa693284b076e5d2cc100758a34b76db65e58/ +Subject: Remove arrows from polygon with single point, ticket #114 + When sanitizing line objects, a polygon consisting of too few points is + converted to a polyline. With this commit, the resulting polyline is + also sanitized, e.g, by removing arrow tips if the line consists only of + a single point. + +--- a/fig2dev/read.c ++++ b/fig2dev/read.c +@@ -3,7 +3,7 @@ + * Copyright (c) 1991 by Micah Beck + * Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul + * Parts Copyright (c) 1989-2015 by Brian V. Smith +- * Parts Copyright (c) 2015-2020 by Thomas Loimer ++ * Parts Copyright (c) 2015-2021 by Thomas Loimer + * + * Any party obtaining a copy of these files is granted, free of charge, a + * full and unrestricted irrevocable, world-wide, paid up, royalty-free, +@@ -951,6 +951,7 @@ sanitize_lineobject( + put_msg("A polygon with %d points at line %d - convert to a polyline.", + npts, line_no); + l->type = T_POLYLINE; ++ sanitize_lineobject(l, p, line_no); + return 0; + } + } +--- a/fig2dev/tests/read.at ++++ b/fig2dev/tests/read.at +@@ -121,7 +121,7 @@ EOF + ]) + AT_CLEANUP + +-AT_SETUP([remove arrows tips from single point]) ++AT_SETUP([remove arrow tips from single point]) + AT_KEYWORDS(read.c polyline) + AT_CHECK([fig2dev -L pict2e <<EOF + FIG_FILE_TOP +@@ -134,6 +134,19 @@ EOF + A single point with a backward arrow - remove the arrow. + ]) + AT_CLEANUP ++ ++AT_SETUP([remove arrow tips on polygon with single point]) ++AT_KEYWORDS(read.c polygon) ++AT_CHECK([fig2dev -L svg <<EOF ++FIG_FILE_TOP ++2 3 0 1 -1 -1 50 -1 -1 0. 0 0 0 0 1 1 ++ 0 0 2. 120. 240. ++ 0 0 ++EOF ++],0,ignore,[A polygon with 1 points at line 12 - convert to a polyline. ++A single point with a backward arrow - remove the arrow. ++]) ++AT_CLEANUP + + AT_SETUP([convert short polygon to polyline, ticket #56]) + AT_KEYWORDS(read.c polygon) diff -Nru fig2dev-3.2.7a/debian/patches/47_trunc-subsuper.patch fig2dev-3.2.7a/debian/patches/47_trunc-subsuper.patch --- fig2dev-3.2.7a/debian/patches/47_trunc-subsuper.patch 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/47_trunc-subsuper.patch 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,71 @@ +From: Thomas Loimer <[email protected]> +Date: Sat Apr 24 10:29:59 2021 +0200 +Bug: https://sourceforge.net/p/mcj/tickets/113/ +Bug: https://sourceforge.net/p/mcj/tickets/117/ +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fig2dev/+bug/1926674 +Applied-Upstream: https://sourceforge.net/p/mcj/fig2dev/ci/f8ce1ff8837056b12c046f56e3b5248b2c8eeaa1/ +Subject: Allow truncated sub/superscripts in text, #113, #117 + For svg output, sub- and superscripts are indicated by the ^ and _ + characters, respectively. A text string truncated right after these + characters caused buffer overflow. Fixes tickets #113 and #117. + +--- a/fig2dev/dev/gensvg.c ++++ b/fig2dev/dev/gensvg.c +@@ -969,7 +969,7 @@ gensvg_text(F_text *t) + #endif + for (cp = (unsigned char *) t->cstring; *cp; cp++) { + ch = *cp; +- if (( supsub == 2 &&ch == '}' ) || supsub==1) { ++ if ((supsub == 2 && ch == '}') || supsub==1) { + #ifdef NOSUPER + fprintf(tfp,"</tspan><tspan dy=\"%d\">",-dy); + old_dy=-dy; +@@ -983,6 +983,8 @@ gensvg_text(F_text *t) + } + } + if (ch == '_' || ch == '^') { ++ if (*(cp + 1) == '\0') ++ break; + supsub=1; + #ifdef NOSUPER + if (dy != 0) +@@ -1007,6 +1009,8 @@ gensvg_text(F_text *t) + ++cp; + ch = *cp; + if (ch == '{' ) { ++ if (*(cp + 1) == '\0') ++ break; + supsub=2; + ++cp; + ch = *cp; +--- a/fig2dev/tests/output.at ++++ b/fig2dev/tests/output.at +@@ -155,6 +155,17 @@ AT_CHECK([SOURCE_DATE_EPOCH=1483564881 f + $srcdir/data/fillswclip.fig | diff - $srcdir/data/fillswclip.svg]) + AT_CLEANUP + ++AT_SETUP([truncated sub/superscript, tickets #113, #117]) ++AT_KEYWORDS(read.c svg) ++AT_CHECK([fig2dev -L svg <<EOF ++#FIG 2 ++1200 2 ++4 2 0 0 1 0 0 0 6 110 376 0 0 ^ ++4 2 0 0 1 0 0 0 6 110 376 0 200 ^{ ++EOF ++], 0, ignore) ++AT_CLEANUP ++ + + AT_BANNER([Test tikz output language.]) + +--- a/fig2dev/tests/read.at ++++ b/fig2dev/tests/read.at +@@ -136,7 +136,7 @@ A single point with a backward arrow - r + AT_CLEANUP + + AT_SETUP([remove arrow tips on polygon with single point]) +-AT_KEYWORDS(read.c polygon) ++AT_KEYWORDS(read.c polygon svg) + AT_CHECK([fig2dev -L svg <<EOF + FIG_FILE_TOP + 2 3 0 1 -1 -1 50 -1 -1 0. 0 0 0 0 1 1 diff -Nru fig2dev-3.2.7a/debian/patches/48_arrow-point.patch fig2dev-3.2.7a/debian/patches/48_arrow-point.patch --- fig2dev-3.2.7a/debian/patches/48_arrow-point.patch 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/48_arrow-point.patch 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,54 @@ +From: Thomas Loimer <[email protected]> +Date: Sat Apr 24 23:04:36 2021 +0200 +Bug: https://sourceforge.net/p/mcj/tickets/115/ +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fig2dev/+bug/1926676 +Applied-Upstream: https://sourceforge.net/p/mcj/fig2dev/ci/8c0917994e49110004a6632d0a66ea19501ad39d/ +Subject: Omit arrows without points in svg output, ticket #115 + +--- a/fig2dev/dev/gensvg.c ++++ b/fig2dev/dev/gensvg.c +@@ -1145,7 +1145,7 @@ svg_arrows(int line_thickness, F_arrow * + return true; + } + +- if (for_arrow) { ++ if (for_arrow && fnpoints > 1) { + fputs("<!-- Forward arrow", tfp); + arrow_path(for_arrow, forw2, pen_color, fnpoints, fpoints, + fnfillpoints, ffillpoints +@@ -1154,7 +1154,7 @@ svg_arrows(int line_thickness, F_arrow * + #endif + ); + } +- if (back_arrow) { ++ if (back_arrow && bnpoints > 1) { + fputs("<!-- Backward arrow", tfp); + arrow_path(back_arrow, back2, pen_color, bnpoints, bpoints, + bnfillpoints, bfillpoints +--- a/fig2dev/tests/output.at ++++ b/fig2dev/tests/output.at +@@ -115,6 +115,7 @@ AT_CHECK([fig2dev -L pict2e -G0.2:1cm de + AT_CLEANUP + + ++ + AT_BANNER([Test svg output language.]) + AT_SETUP([compare patterns with template]) + AT_KEYWORDS(svg pattern creationdate) +@@ -166,6 +167,16 @@ EOF + ], 0, ignore) + AT_CLEANUP + ++AT_SETUP([omit arrows without points, ticket #115]) ++AT_KEYWORDS(svg arrow) ++AT_CHECK([fig2dev -L svg <<EOF ++FIG_FILE_TOP ++5 1 0 1 7 7 44 -1 6 0.000 0 1 1 1 50 -1 -1500 200 -1 7 50 -1 900 750 975 ++ 0 0 1.00 45.00 90.00 ++ 5 0 1.003 1426 1068 1426 ++EOF], 0, ignore) ++AT_CLEANUP ++ + + AT_BANNER([Test tikz output language.]) + diff -Nru fig2dev-3.2.7a/debian/patches/series fig2dev-3.2.7a/debian/patches/series --- fig2dev-3.2.7a/debian/patches/series 2020-01-07 19:53:09.000000000 +0100 +++ fig2dev-3.2.7a/debian/patches/series 2021-05-22 11:20:55.000000000 +0200 @@ -15,3 +15,8 @@ 41_CVE-2019-19555.patch 42_CVE-2019-19746.patch 43_fgets2getline.patch +44_CVE-2021-3561.patch +45_polygon2polyline.patch +46_arroy-poly.patch +47_trunc-subsuper.patch +48_arrow-point.patch diff -Nru fig2dev-3.2.7a/debian/rules fig2dev-3.2.7a/debian/rules --- fig2dev-3.2.7a/debian/rules 2020-01-07 19:53:09.000000000 +0100 +++ fig2dev-3.2.7a/debian/rules 2021-05-22 11:20:55.000000000 +0200 @@ -21,6 +21,8 @@ fi dh_auto_configure -- --enable-transfig +# rebuild testsuite: + (cd fig2dev/tests; rm -f testsuite; make testsuite) override_dh_auto_build: dh_auto_build diff -Nru fig2dev-3.2.7a/debian/salsa-ci.yml fig2dev-3.2.7a/debian/salsa-ci.yml --- fig2dev-3.2.7a/debian/salsa-ci.yml 1970-01-01 01:00:00.000000000 +0100 +++ fig2dev-3.2.7a/debian/salsa-ci.yml 2021-05-22 11:20:55.000000000 +0200 @@ -0,0 +1,7 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml + +variables: + RELEASE: 'buster' diff -Nru fig2dev-3.2.7a/debian/tests/fig2dev-testsuite fig2dev-3.2.7a/debian/tests/fig2dev-testsuite --- fig2dev-3.2.7a/debian/tests/fig2dev-testsuite 2020-01-07 19:53:09.000000000 +0100 +++ fig2dev-3.2.7a/debian/tests/fig2dev-testsuite 2021-05-22 11:20:55.000000000 +0200 @@ -10,6 +10,9 @@ dh_auto_configure >/dev/null 2>&1 cd fig2dev/tests +echo "Rebuild testsuite" +rm -f testsuite +make testsuite echo "Running check and installcheck" # (check builds check_PROGRAMS) make check installcheck
