Bas Couwenberg pushed to branch buster-backports at Debian GIS Project / mapserver
Commits: c111781d by Bas Couwenberg at 2020-03-20T20:53:38+01:00 Add upstream patch to fix PHPMapScript error handling vulnerabilities. - - - - - f805ff79 by Bas Couwenberg at 2020-03-20T20:54:29+01:00 Set distribution to buster-backports. - - - - - 3 changed files: - debian/changelog - + debian/patches/mapscript-buffer-overflow.patch - debian/patches/series Changes: ===================================== debian/changelog ===================================== @@ -1,3 +1,9 @@ +mapserver (7.4.3-1~bpo10+2) buster-backports; urgency=high + + * Add upstream patch to fix PHPMapScript error handling vulnerabilities. + + -- Bas Couwenberg <[email protected]> Fri, 20 Mar 2020 20:53:42 +0100 + mapserver (7.4.3-1~bpo10+1) buster-backports; urgency=medium * Rebuild for buster-backports. ===================================== debian/patches/mapscript-buffer-overflow.patch ===================================== @@ -0,0 +1,62 @@ +Description: Fix PHPMapScript vulnerabilities in error handling. +Author: Jeff McKenna <[email protected]> +Bug: https://github.com/mapserver/mapserver/issues/6014 + +--- a/mapscript/php/mapscript_error.c ++++ b/mapscript/php/mapscript_error.c +@@ -35,8 +35,6 @@ + #include <stdarg.h> + #include "../../maperror.h" + +-#define MAX_EXCEPTION_MSG 256 +- + zend_class_entry *mapscript_ce_mapscriptexception; + + #if PHP_VERSION_ID >= 70000 +@@ -46,9 +44,10 @@ zval* mapscript_throw_exception(char *fo + #endif + { + va_list args; +- char message[MAX_EXCEPTION_MSG]; ++ char message[MESSAGELENGTH]; + va_start(args, format); +- vsprintf(message, format, args); ++ //prevent buffer overflow ++ vsnprintf(message, MESSAGELENGTH, format, args); + va_end(args); + return zend_throw_exception(mapscript_ce_mapscriptexception, message, 0 TSRMLS_CC); + } +@@ -60,7 +59,7 @@ zval* mapscript_throw_mapserver_exceptio + #endif + { + va_list args; +- char message[MAX_EXCEPTION_MSG]; ++ char message[MESSAGELENGTH]; + errorObj *ms_error; + + ms_error = msGetErrorObj(); +@@ -73,17 +72,20 @@ zval* mapscript_throw_mapserver_exceptio + } + + va_start(args, format); +- vsprintf(message, format, args); ++ //prevent buffer overflow ++ vsnprintf(message, MESSAGELENGTH, format, args); + va_end(args); +- return mapscript_throw_exception(message TSRMLS_CC); ++ //prevent format string attack ++ return mapscript_throw_exception("%s", message TSRMLS_CC); + } + + void mapscript_report_php_error(int error_type, char *format TSRMLS_DC, ...) + { + va_list args; +- char message[MAX_EXCEPTION_MSG]; ++ char message[MESSAGELENGTH]; + va_start(args, format); +- vsprintf(message, format, args); ++ //prevent buffer overflow ++ vsnprintf(message, MESSAGELENGTH, format, args); + va_end(args); + php_error_docref(NULL TSRMLS_CC, error_type, "%s,", message); + } ===================================== debian/patches/series ===================================== @@ -1,2 +1,3 @@ perl-mapscript-install.patch java-hardening.patch +mapscript-buffer-overflow.patch View it on GitLab: https://salsa.debian.org/debian-gis-team/mapserver/-/compare/10ced127578184356dd488181776f79741d79187...f805ff79fac76591d9390459d51b22b82716d13a -- View it on GitLab: https://salsa.debian.org/debian-gis-team/mapserver/-/compare/10ced127578184356dd488181776f79741d79187...f805ff79fac76591d9390459d51b22b82716d13a You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ Pkg-grass-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-grass-devel
