diff options
| author | Maxim Cournoyer <maxim.cournoyer@gmail.com> | 2021-10-01 17:10:49 -0400 |
|---|---|---|
| committer | Maxim Cournoyer <maxim.cournoyer@gmail.com> | 2021-10-01 17:10:49 -0400 |
| commit | 2e65e4834a226c570866f2e8976ed7f252b45cd1 (patch) | |
| tree | 21d625bce8d03627680214df4a6622bf8eb79dc9 /gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch | |
| parent | 9c68ecb24dd1660ce736cdcdea0422a73ec318a2 (diff) | |
| parent | f1a3c11407b52004e523ec5de20d326c5661681f (diff) | |
| download | guix-2e65e4834a226c570866f2e8976ed7f252b45cd1.tar.gz | |
Merge remote-tracking branch 'origin/master' into staging
With resolved conflicts in: gnu/packages/bittorrent.scm gnu/packages/databases.scm gnu/packages/geo.scm gnu/packages/gnupg.scm gnu/packages/gstreamer.scm gnu/packages/gtk.scm gnu/packages/linux.scm gnu/packages/python-xyz.scm gnu/packages/xorg.scm guix/build/qt-utils.scm
Diffstat (limited to 'gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch')
| -rw-r--r-- | gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch b/gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch new file mode 100644 index 0000000000..85ea29cc38 --- /dev/null +++ b/gnu/packages/patches/perl-image-exiftool-CVE-2021-22204.patch @@ -0,0 +1,38 @@ +Fix CVE-2021-22204: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204 + +Patch extracted from commit cf0f4e7dcd024ca99615bfd1102a841a25dde031 +from upstream source repository: + +https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 + +diff --git a/lib/Image/ExifTool/DjVu.pm b/lib/Image/ExifTool/DjVu.pm +index c284d10..03b3f9f 100644 +--- a/lib/Image/ExifTool/DjVu.pm ++++ b/lib/Image/ExifTool/DjVu.pm +@@ -18,7 +18,7 @@ use strict; + use vars qw($VERSION); + use Image::ExifTool qw(:DataAccess :Utils); + +-$VERSION = '1.06'; ++$VERSION = '1.07'; + + sub ParseAnt($); + sub ProcessAnt($$$); +@@ -227,10 +227,11 @@ Tok: for (;;) { + last unless $tok =~ /(\\+)$/ and length($1) & 0x01; + $tok .= '"'; # quote is part of the string + } +- # must protect unescaped "$" and "@" symbols, and "\" at end of string +- $tok =~ s{\\(.)|([\$\@]|\\$)}{'\\'.($2 || $1)}sge; +- # convert C escape sequences (allowed in quoted text) +- $tok = eval qq{"$tok"}; ++ # convert C escape sequences, allowed in quoted text ++ # (note: this only converts a few of them!) ++ my %esc = ( a => "\a", b => "\b", f => "\f", n => "\n", ++ r => "\r", t => "\t", '"' => '"', '\\' => '\\' ); ++ $tok =~ s/\\(.)/$esc{$1}||'\\'.$1/egs; + } else { # key name + pos($$dataPt) = pos($$dataPt) - 1; + # allow anything in key but whitespace, braces and double quotes |