diff options
Diffstat (limited to 'poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch')
| -rw-r--r-- | poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch new file mode 100644 index 000000000..e406086e8 --- /dev/null +++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch @@ -0,0 +1,37 @@ +From b39be1019b4acc1aa50c6026463c543332e95a31 Mon Sep 17 00:00:00 2001 +From: Catalin Enache <catalin.enache@windriver.com> +Date: Mon, 8 May 2017 16:18:14 +0300 + +Subject: [PATCH] Bug 697693: Prevent SEGV due to integer overflow. + +While building a Huffman table, the start and end points were susceptible +to integer overflow. + +Thank you to Jiaqi for finding this issue and suggesting a patch. + +Upstream-Status: Backport +CVE: CVE-2017-7975 + +Signed-off-by: Catalin Enache <catalin.enache@windriver.com> + +Contents of this patch were extracted from a larger patch which addressed +two CVE's. The context (location of {) was also modified to apply to +ghostscript 9.21. + +Signed-off-by: Joe Slater <joe.slater@windriver.com> + + +--- a/jbig2dec/jbig2_huffman.c ++++ b/jbig2dec/jbig2_huffman.c +@@ -421,8 +421,8 @@ jbig2_build_huffman_table(Jbig2Ctx *ctx, + + if (PREFLEN == CURLEN) { + int RANGELEN = lines[CURTEMP].RANGELEN; +- int start_j = CURCODE << shift; +- int end_j = (CURCODE + 1) << shift; ++ uint32_t start_j = CURCODE << shift; ++ uint32_t end_j = (CURCODE + 1) << shift; + byte eflags = 0; + + if (end_j > max_j) { + |
