diff options
| author | Efraim Flashner <efraim@flashner.co.il> | 2017-09-06 14:19:50 +0300 |
|---|---|---|
| committer | Efraim Flashner <efraim@flashner.co.il> | 2017-09-06 14:20:43 +0300 |
| commit | 98df3a88b5e323087db6097094f119fa4663f6d3 (patch) | |
| tree | a541a2679707d8a58f1b3695ed6dc2bbcaa7af62 /gnu/packages/patches | |
| parent | 3b7c606965656e95725e9cd5f1c7cfc4d0ea18cf (diff) | |
| download | guix-98df3a88b5e323087db6097094f119fa4663f6d3.tar.gz | |
gnu: libzip: Update to 1.3.0 (fixes CVE-2017-14107).
* gnu/packages/compression.scm (libzip): Update to 1.3.0. [source]: Remove patch. [arguments]: Remove custom 'patch-perl phase. * gnu/packages/patches/libzip-CVE-2017-12858.patch: Remove file. * gnu/local.mk (dist_patch_DATA): Remove it.
Diffstat (limited to 'gnu/packages/patches')
| -rw-r--r-- | gnu/packages/patches/libzip-CVE-2017-12858.patch | 45 |
1 files changed, 0 insertions, 45 deletions
diff --git a/gnu/packages/patches/libzip-CVE-2017-12858.patch b/gnu/packages/patches/libzip-CVE-2017-12858.patch deleted file mode 100644 index 8125173f95..0000000000 --- a/gnu/packages/patches/libzip-CVE-2017-12858.patch +++ /dev/null @@ -1,45 +0,0 @@ -Fix CVE-2017-12858: - -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12858 - -Patch copied from upstream source repository: - -https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796 - -From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001 -From: Thomas Klausner <tk@giga.or.at> -Date: Mon, 14 Aug 2017 10:55:44 +0200 -Subject: [PATCH] Fix double free(). - -Found by Brian 'geeknik' Carpenter using AFL. ---- - THANKS | 1 + - lib/zip_dirent.c | 3 --- - 2 files changed, 1 insertion(+), 3 deletions(-) - -diff --git a/THANKS b/THANKS -index be0cca9..a80ee1d 100644 ---- a/THANKS -+++ b/THANKS -@@ -12,6 +12,7 @@ BALATON Zoltan <balaton@eik.bme.hu> - Benjamin Gilbert <bgilbert@backtick.net> - Boaz Stolk <bstolk@aweta.nl> - Bogdan <bogiebog@gmail.com> -+Brian 'geeknik' Carpenter <geeknik@protonmail.ch> - Chris Nehren <cnehren+libzip@pobox.com> - Coverity <info@coverity.com> - Dane Springmeyer <dane.springmeyer@gmail.com> -diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c -index a369900..e5a7cc9 100644 ---- a/lib/zip_dirent.c -+++ b/lib/zip_dirent.c -@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo - } - - if (!_zip_dirent_process_winzip_aes(zde, error)) { -- if (!from_buffer) { -- _zip_buffer_free(buffer); -- } - return -1; - } - |