Emilio Pozuelo Monfort pushed to branch debian-unstable at X Strike Force / lib / pixman
Commits: e71a54d0 by Emilio Pozuelo Monfort at 2022-11-08T13:03:18+01:00 Import 0.40.0-1.1 NMU * Avoid integer overflow leading to out-of-bounds write (CVE-2022-44638) (Closes: #1023427) - - - - - 3 changed files: - debian/changelog - + debian/patches/Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff - debian/patches/series Changes: ===================================== debian/changelog ===================================== @@ -1,3 +1,11 @@ +pixman (0.40.0-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * Avoid integer overflow leading to out-of-bounds write (CVE-2022-44638) + (Closes: #1023427) + + -- Salvatore Bonaccorso <car...@debian.org> Thu, 03 Nov 2022 23:07:46 +0100 + pixman (0.40.0-1) unstable; urgency=medium * New upstream release. (Closes: #958298, #832579, #838650) ===================================== debian/patches/Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff ===================================== @@ -0,0 +1,32 @@ +From: Matt Turner <matts...@gmail.com> +Date: Wed, 2 Nov 2022 12:07:32 -0400 +Subject: Avoid integer overflow leading to out-of-bounds write +Origin: https://gitlab.freedesktop.org/pixman/pixman/-/commit/a1f88e842e0216a5b4df1ab023caebe33c101395 +Bug: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 +Bug-Debian: https://bugs.debian.org/1023427 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-44638 + +Thanks to Maddie Stone and Google's Project Zero for discovering this +issue, providing a proof-of-concept, and a great analysis. + +Closes: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 +--- + pixman/pixman-trap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pixman/pixman-trap.c b/pixman/pixman-trap.c +index 91766fdbfca0..7560405ee2e4 100644 +--- a/pixman/pixman-trap.c ++++ b/pixman/pixman-trap.c +@@ -74,7 +74,7 @@ pixman_sample_floor_y (pixman_fixed_t y, + + if (f < Y_FRAC_FIRST (n)) + { +- if (pixman_fixed_to_int (i) == 0x8000) ++ if (pixman_fixed_to_int (i) == 0xffff8000) + { + f = 0; /* saturate */ + } +-- +2.37.2 + ===================================== debian/patches/series ===================================== @@ -1 +1,2 @@ test-increase-timeout.diff +Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff View it on GitLab: https://salsa.debian.org/xorg-team/lib/pixman/-/commit/e71a54d0f04f0d1fbb7739458ef881c6e812616c -- View it on GitLab: https://salsa.debian.org/xorg-team/lib/pixman/-/commit/e71a54d0f04f0d1fbb7739458ef881c6e812616c You're receiving this email because of your account on salsa.debian.org.