amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: ExifTool: Fix CVE-2021-22204

Browse source 
* gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/photo.scm (perl-image-exiftool)[source]: Use it.
This commit is contained in:
Leo Famulari 2021-05-09 10:41:02 -04:00
parent f661e6883e
commit 0f2b5f7f73
No known key found for this signature in database
GPG key ID: 2646FA30BACA7F08
3 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

38
gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch Normal file
View file

@ -0,0 +1,38 @@
Fix CVE-2021-22204:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204
Patch extracted from commit cf0f4e7dcd024ca99615bfd1102a841a25dde031
from upstream source repository:
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
diff --git a/lib/Image/ExifTool/DjVu.pm b/lib/Image/ExifTool/DjVu.pm
index c284d10..03b3f9f 100644
--- a/lib/Image/ExifTool/DjVu.pm
+++ b/lib/Image/ExifTool/DjVu.pm
@@ -18,7 +18,7 @@ use strict;
use vars qw($VERSION);
use Image::ExifTool qw(:DataAccess :Utils);
-$VERSION = '1.06';
+$VERSION = '1.07';
sub ParseAnt($);
sub ProcessAnt($$$);
@@ -227,10 +227,11 @@ Tok: for (;;) {
last unless $tok =~ /(\\+)$/ and length($1) & 0x01;
$tok .= '"'; # quote is part of the string
}
- # must protect unescaped "$" and "@" symbols, and "\" at end of string
- $tok =~ s{\\(.)|([\$\@]|\\$)}{'\\'.($2 || $1)}sge;
- # convert C escape sequences (allowed in quoted text)
- $tok = eval qq{"$tok"};
+ # convert C escape sequences, allowed in quoted text
+ # (note: this only converts a few of them!)
+ my %esc = ( a => "\a", b => "\b", f => "\f", n => "\n",
+ r => "\r", t => "\t", '"' => '"', '\\' => '\\' );
+ $tok =~ s/\\(.)/$esc{$1}||'\\'.$1/egs;
} else { # key name
pos($$dataPt) = pos($$dataPt) - 1;
# allow anything in key but whitespace, braces and double quotes