From: Lee Chee Yang <chee.yang....@intel.com> Signed-off-by: Lee Chee Yang <chee.yang....@intel.com> --- .../xorg-lib/libxpm/CVE-2022-46285.patch | 40 +++++++++++++++++++ .../xorg-lib/libxpm_3.5.13.bb | 2 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch
diff --git a/meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch b/meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch new file mode 100644 index 0000000000..e8b654dfb2 --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch @@ -0,0 +1,40 @@ +CVE: CVE-2022-46285 +Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148 ] +Signed-off-by: Lee Chee Yang <chee.yang....@intel.com> + +From a3a7c6dcc3b629d765014816c566c63165c63ca8 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersm...@oracle.com> +Date: Sat, 17 Dec 2022 12:23:45 -0800 +Subject: [PATCH] Fix CVE-2022-46285: Infinite loop on unclosed comments + +When reading XPM images from a file with libXpm 3.5.14 or older, if a +comment in the file is not closed (i.e. a C-style comment starts with +"/*" and is missing the closing "*/"), the ParseComment() function will +loop forever calling getc() to try to read the rest of the comment, +failing to notice that it has returned EOF, which may cause a denial of +service to the calling program. + +Reported-by: Marco Ivaldi <rap...@0xdeadbeef.info> +Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> +--- + src/data.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/data.c b/src/data.c +index 898889c..bfad4ff 100644 +--- a/src/data.c ++++ b/src/data.c +@@ -174,6 +174,10 @@ ParseComment(xpmData *data) + notend = 0; + Ungetc(data, *s, file); + } ++ else if (c == EOF) { ++ /* hit end of file before the end of the comment */ ++ return XpmFileInvalid; ++ } + } + return 0; + } +-- +GitLab + diff --git a/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb b/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb index fda8e32d2c..8937e61cb5 100644 --- a/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb +++ b/meta/recipes-graphics/xorg-lib/libxpm_3.5.13.bb @@ -21,6 +21,8 @@ PACKAGES =+ "sxpm cxpm" FILES_cxpm = "${bindir}/cxpm" FILES_sxpm = "${bindir}/sxpm" +SRC_URI += " file://CVE-2022-46285.patch" + SRC_URI[md5sum] = "6f0ecf8d103d528cfc803aa475137afa" SRC_URI[sha256sum] = "9cd1da57588b6cb71450eff2273ef6b657537a9ac4d02d0014228845b935ac25" -- 2.37.3
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#187269): https://lists.openembedded.org/g/openembedded-core/message/187269 Mute This Topic: https://lists.openembedded.org/mt/101185746/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
