diff options
| -rw-r--r-- | user/exiv2/APKBUILD | 10 | ||||
| -rw-r--r-- | user/exiv2/CVE-2018-19535.patch | 239 |
2 files changed, 247 insertions, 2 deletions
diff --git a/user/exiv2/APKBUILD b/user/exiv2/APKBUILD index d9ced3064..12c8c21c6 100644 --- a/user/exiv2/APKBUILD +++ b/user/exiv2/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=exiv2 pkgver=0.26 -pkgrel=1 +pkgrel=2 pkgdesc="Exif, IPTC and XMP metadata library and tools" url="http://www.exiv2.org" arch="all" @@ -14,9 +14,14 @@ subpackages="$pkgname-dev $pkgname-doc" source="http://www.exiv2.org/builds/exiv2-$pkgver-trunk.tar.gz 0000-pthread-init-fix.patch 0001-Amend-fix-for-9-to-apply-to-other-Unix-systems.patch + CVE-2018-19535.patch " builddir="$srcdir"/exiv2-trunk +# secfixes: +# 0.26-r2: +# - CVE-2018-19535 + prepare() { cd "$builddir" default_prepare @@ -38,4 +43,5 @@ package() { sha512sums="d1e9cab886e279b045768dd9ec781f07d2d36d573119403d0b76dc571442173aae6972f86ec55c3ea53fb3ee9ca3571eb8fd63a2a6643a970852813e88634a86 exiv2-0.26-trunk.tar.gz 9721d359708c385be7c86a8f8a63de43b05b2578a29b4339861e82873aa81a98a7ee7252847b6c55529341187d40f552c488589b416fd9d1e27418925929c018 0000-pthread-init-fix.patch -485bd340169f69a3ce356e59e9138250cc14592f4477bb73827c799fe465535954469634fc58a1856f690f0e0b4171cba6fdd3391d43c0efc5e89652b93eb3ce 0001-Amend-fix-for-9-to-apply-to-other-Unix-systems.patch" +485bd340169f69a3ce356e59e9138250cc14592f4477bb73827c799fe465535954469634fc58a1856f690f0e0b4171cba6fdd3391d43c0efc5e89652b93eb3ce 0001-Amend-fix-for-9-to-apply-to-other-Unix-systems.patch +ac145a9b4df21e7f5fdd3099e6ae4c1e12ae2cdccc455d0262c5d38b8e07ce6437036a19264bd04b1cb1fffd01d89672044ca82fddd5e71dcd0d84d48356ab12 CVE-2018-19535.patch" diff --git a/user/exiv2/CVE-2018-19535.patch b/user/exiv2/CVE-2018-19535.patch new file mode 100644 index 000000000..ba9355012 --- /dev/null +++ b/user/exiv2/CVE-2018-19535.patch @@ -0,0 +1,239 @@ +From 03173751b4d7053d6ddf52a15904e8f751f78f56 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Luis=20D=C3=ADaz=20M=C3=A1s?= <piponazo@gmail.com> +Date: Sun, 2 Sep 2018 14:39:52 +0200 +Subject: [PATCH 2/5] Fix bug in PngChunk::readRawProfile + +- Now it takes into account text.size_ when searching for a newline +char. +--- + src/pngchunk.cpp | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/pngchunk.cpp b/src/pngchunk.cpp +index 58281b3ff..755872c94 100644 +--- a/src/pngchunk.cpp ++++ b/src/pngchunk.cpp +@@ -629,11 +629,19 @@ namespace Exiv2 { + + + sp = (char*)text.pData_+1; ++ int pointerPos = 1; + + // Look for newline +- +- while (*sp != '\n') ++ while (*sp != '\n' && pointerPos < (text.size_ - 1)) ++ { + sp++; ++ pointerPos++; ++ } ++ ++ if (pointerPos == (text.size_ - 1)) ++ { ++ return DataBuf(); ++ } + + // Look for length + + +From cf3ba049a2792ec2a4a877e343f5dd9654da53dc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Luis=20D=C3=ADaz=20M=C3=A1s?= <piponazo@gmail.com> +Date: Mon, 3 Sep 2018 08:51:08 +0200 +Subject: [PATCH 3/5] Fix more issues in PngChunk::readRawProfile + +--- + src/pngchunk.cpp | 36 +++++++++++++----------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/src/pngchunk.cpp b/src/pngchunk.cpp +index 755872c94..9b3faf1aa 100644 +--- a/src/pngchunk.cpp ++++ b/src/pngchunk.cpp +@@ -606,11 +606,6 @@ namespace Exiv2 { + DataBuf PngChunk::readRawProfile(const DataBuf& text,bool iTXt) + { + DataBuf info; +- register long i; +- register unsigned char *dp; +- const char *sp; +- unsigned int nibbles; +- long length; + unsigned char unhex[103]={0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, + 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, + 0,0,0,0,0,0,0,0,0,1, 2,3,4,5,6,7,8,9,0,0, +@@ -627,8 +622,7 @@ namespace Exiv2 { + return info; + } + +- +- sp = (char*)text.pData_+1; ++ const char *sp = (char*)text.pData_+1; + int pointerPos = 1; + + // Look for newline +@@ -638,20 +632,30 @@ namespace Exiv2 { + pointerPos++; + } + ++ // Look for length ++ while ((*sp == '\0' || *sp == ' ' || *sp == '\n') && pointerPos < (text.size_ - 1)) ++ { ++ sp++; ++ pointerPos++; ++ } ++ + if (pointerPos == (text.size_ - 1)) + { + return DataBuf(); + } + +- // Look for length ++ long length = (long) atol(sp); + +- while (*sp == '\0' || *sp == ' ' || *sp == '\n') ++ while (*sp != ' ' && *sp != '\n' && pointerPos < (text.size_ - 1)) ++ { + sp++; ++ pointerPos++; ++ } + +- length = (long) atol(sp); +- +- while (*sp != ' ' && *sp != '\n') +- sp++; ++ if (pointerPos == (text.size_ - 1)) ++ { ++ return DataBuf(); ++ } + + // Allocate space + +@@ -674,10 +678,10 @@ namespace Exiv2 { + + // Copy profile, skipping white space and column 1 "=" signs + +- dp = (unsigned char*)info.pData_; +- nibbles = length * 2; ++ unsigned char *dp = (unsigned char*)info.pData_; ++ unsigned int nibbles = length * 2; + +- for (i = 0; i < (long) nibbles; i++) ++ for (long i = 0; i < (long) nibbles; i++) + { + while (*sp < '0' || (*sp > '9' && *sp < 'a') || *sp > 'f') + { + +From 8b480bc5b2cc2abb8cf6fe4e16c24e58916464d2 Mon Sep 17 00:00:00 2001 +From: Robin Mills <robin@clanmills.com> +Date: Mon, 10 Sep 2018 20:54:53 +0200 +Subject: [PATCH 4/5] Fixes in PngChunk::readRawProfile + +--- + src/pngchunk.cpp | 55 ++++++++++++++++++++++---------------------- + 1 file changed, 27 insertions(+), 28 deletions(-) + +diff --git a/src/pngchunk.cpp b/src/pngchunk.cpp +index 9b3faf1aa..f81b560aa 100644 +--- a/src/pngchunk.cpp ++++ b/src/pngchunk.cpp +@@ -607,11 +607,11 @@ namespace Exiv2 { + { + DataBuf info; + unsigned char unhex[103]={0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, +- 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, +- 0,0,0,0,0,0,0,0,0,1, 2,3,4,5,6,7,8,9,0,0, +- 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, +- 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,10,11,12, +- 13,14,15}; ++ 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, ++ 0,0,0,0,0,0,0,0,0,1, 2,3,4,5,6,7,8,9,0,0, ++ 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0, ++ 0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,10,11,12, ++ 13,14,15}; + if (text.size_ == 0) { + return DataBuf(); + } +@@ -622,52 +622,51 @@ namespace Exiv2 { + return info; + } + +- const char *sp = (char*)text.pData_+1; +- int pointerPos = 1; ++ const char *sp = (char*) text.pData_+1; // current byte (space pointer) ++ const char *eot = (char*) text.pData_+text.size_; // end of text + + // Look for newline +- while (*sp != '\n' && pointerPos < (text.size_ - 1)) ++ while (*sp != '\n' && sp < eot ) + { + sp++; +- pointerPos++; ++ if ( sp == eot ) ++ { ++ return DataBuf(); ++ } + } ++ sp++ ; // step over '\n' + + // Look for length +- while ((*sp == '\0' || *sp == ' ' || *sp == '\n') && pointerPos < (text.size_ - 1)) ++ while ( (*sp == '\0' || *sp == ' ' || *sp == '\n') && sp < eot ) + { + sp++; +- pointerPos++; +- } +- +- if (pointerPos == (text.size_ - 1)) +- { +- return DataBuf(); ++ if (sp == eot ) ++ { ++ return DataBuf(); ++ } + } + +- long length = (long) atol(sp); +- +- while (*sp != ' ' && *sp != '\n' && pointerPos < (text.size_ - 1)) ++ const char* startOfLength = sp; ++ while ( ('0' <= *sp && *sp <= '9') && sp < eot) + { + sp++; +- pointerPos++; ++ if (sp == eot ) ++ { ++ return DataBuf(); ++ } + } ++ sp++ ; // step over '\n' + +- if (pointerPos == (text.size_ - 1)) +- { +- return DataBuf(); +- } ++ long length = (long) atol(startOfLength); + + // Allocate space +- + if (length == 0) + { + #ifdef DEBUG + std::cerr << "Exiv2::PngChunk::readRawProfile: Unable To Copy Raw Profile: invalid profile length\n"; + #endif + } +- + info.alloc(length); +- + if (info.size_ != length) + { + #ifdef DEBUG +@@ -678,7 +677,7 @@ namespace Exiv2 { + + // Copy profile, skipping white space and column 1 "=" signs + +- unsigned char *dp = (unsigned char*)info.pData_; ++ unsigned char *dp = (unsigned char*)info.pData_; // decode pointer + unsigned int nibbles = length * 2; + + for (long i = 0; i < (long) nibbles; i++) + |