amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: t1lib: Fix CVE-2010-2642, CVE-2011-{0764, 1552, 1553, 1554}.

Browse source 
* gnu/packages/fontutils.scm (t1lib)[source]: Add patches.
* gnu/packages/patches/t1lib-CVE-2010-2642.patch,
gnu/packages/patches/t1lib-CVE-2011-0764.patch,
gnu/packages/patches/t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch: New variables.
* gnu/local.mk (dist_patch_DATA): Add them.
This commit is contained in:
Efraim Flashner 2016-05-30 11:46:12 +03:00
parent 321dc4dfe4
commit 4f3e02f198
No known key found for this signature in database
GPG key ID: F4C1D3917EACEE93
5 changed files with 197 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

24
gnu/packages/patches/t1lib-CVE-2010-2642.patch Normal file
View file

@ -0,0 +1,24 @@
diff --git a/lib/t1lib/parseAFM.c b/lib/t1lib/parseAFM.c
index 6a31d7f..ba64541 100644
--- a/lib/t1lib/parseAFM.c
+++ b/lib/t1lib/parseAFM.c
@@ -199,7 +199,9 @@ static char *token(stream)
idx = 0;
while (ch != EOF && ch != ' ' && ch != CR && ch != LF &&
- ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
+ ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'
+ && idx < (MAX_NAME -1))
+ {
ident[idx++] = ch;
ch = fgetc(stream);
} /* while */
@@ -235,7 +237,7 @@ static char *linetoken(stream)
while ((ch = fgetc(stream)) == ' ' || ch == '\t' );
idx = 0;
- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
+ while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z && idx < (MAX_NAME - 1))
{
ident[idx++] = ch;
ch = fgetc(stream);