Backport upstream patch for CVE-2019-15133. Set CVE_PRODUCT to "giflib_project:giflib" which is used in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133
Signed-off-by: Mikko Rapeli <[email protected]> --- .../giflib/files/CVE-2019-15133.patch | 23 +++++++++++++++++++ .../recipes-devtools/giflib/giflib_5.1.4.bb | 7 +++++- 2 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch diff --git a/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch b/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch new file mode 100644 index 000000000..9957be82f --- /dev/null +++ b/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch @@ -0,0 +1,23 @@ +From 799eb6a3af8a3dd81e2429bf11a72a57e541f908 Mon Sep 17 00:00:00 2001 +From: "Eric S. Raymond" <[email protected]> +Date: Sun, 17 Mar 2019 12:37:21 -0400 +Subject: [PATCH] Address SF bug #119: MemorySanitizer: FPE on unknown address + +--- + dgif_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Upstream-status: Backport [https://sourceforge.net/p/giflib/code/ci/799eb6a3af8a3dd81e2429bf11a72a57e541f908/] +CVE: CVE-2019-15133 + +--- a/lib/dgif_lib.c 2021-01-13 19:28:18.923493586 +0100 ++++ b/lib/dgif_lib.c 2021-01-13 19:28:55.245863085 +0100 +@@ -1099,7 +1099,7 @@ DGifSlurp(GifFileType *GifFile) + + sp = &GifFile->SavedImages[GifFile->ImageCount - 1]; + /* Allocate memory for the image */ +- if (sp->ImageDesc.Width < 0 && sp->ImageDesc.Height < 0 && ++ if (sp->ImageDesc.Width <= 0 && sp->ImageDesc.Height <= 0 && + sp->ImageDesc.Width > (INT_MAX / sp->ImageDesc.Height)) { + return GIF_ERROR; + } diff --git a/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb b/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb index 21fa352cd..1871bab46 100644 --- a/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb +++ b/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb @@ -3,7 +3,12 @@ SECTION = "libs" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://COPYING;md5=ae11c61b04b2917be39b11f78d71519a" -SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.bz2" +SRC_URI = " \ + ${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.bz2 \ + file://CVE-2019-15133.patch \ +" + +CVE_PRODUCT = "giflib_project:giflib" inherit autotools -- 2.20.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#88788): https://lists.openembedded.org/g/openembedded-devel/message/88788 Mute This Topic: https://lists.openembedded.org/mt/79698932/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
