diff options
author | Efraim Flashner <efraim@flashner.co.il> | 2019-04-07 21:10:26 +0300 |
---|---|---|
committer | Efraim Flashner <efraim@flashner.co.il> | 2019-04-07 21:10:26 +0300 |
commit | 8a3bb34c5e9aa4bc2042da8541e6cb74de7066f7 (patch) | |
tree | a08fa5b7bf8e3994fd5ff7d27a43c4001d211dbe /gnu/packages | |
parent | 71b4974a40347bdc651c3a1f923780733d96ded7 (diff) | |
download | guix-8a3bb34c5e9aa4bc2042da8541e6cb74de7066f7.tar.gz |
gnu: lcms: Fix CVE-2018-16435.
* gnu/packages/ghostscript.scm (lcms)[replacement]: New field. (lcms/fixed): New variable. * gnu/packages/patches/lcms-CVE-2018-16435.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it.
Diffstat (limited to 'gnu/packages')
-rw-r--r-- | gnu/packages/ghostscript.scm | 11 | ||||
-rw-r--r-- | gnu/packages/patches/lcms-CVE-2018-16435.patch | 171 |
2 files changed, 181 insertions, 1 deletions
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm index d8c0050513..53a9b60fdb 100644 --- a/gnu/packages/ghostscript.scm +++ b/gnu/packages/ghostscript.scm @@ -4,7 +4,7 @@ ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net> ;;; Copyright © 2013, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org> ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com> -;;; Copyright © 2017, 2018 Efraim Flashner <efraim@flashner.co.il> +;;; Copyright © 2017, 2018, 2019 Efraim Flashner <efraim@flashner.co.il> ;;; Copyright © 2017 Leo Famulari <leo@famulari.name> ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com> @@ -47,6 +47,7 @@ (define-public lcms (package (name "lcms") + (replacement lcms/fixed) (version "2.9") (source (origin (method url-fetch) @@ -67,6 +68,14 @@ Consortium standard (ICC), approved as ISO 15076-1.") (home-page "http://www.littlecms.com/") (properties '((cpe-name . "little_cms_color_engine"))))) +(define lcms/fixed + (package + (inherit lcms) + (source + (origin + (inherit (package-source lcms)) + (patches (search-patches "lcms-CVE-2018-16435.patch")))))) + (define-public libpaper (package (name "libpaper") diff --git a/gnu/packages/patches/lcms-CVE-2018-16435.patch b/gnu/packages/patches/lcms-CVE-2018-16435.patch new file mode 100644 index 0000000000..60228e73af --- /dev/null +++ b/gnu/packages/patches/lcms-CVE-2018-16435.patch @@ -0,0 +1,171 @@ +https://github.com/mm2/Little-CMS/commit/768f70ca405cd3159d990e962d54456773bb8cf8.patch + +From 768f70ca405cd3159d990e962d54456773bb8cf8 Mon Sep 17 00:00:00 2001 +From: Marti Maria <info@littlecms.com> +Date: Wed, 15 Aug 2018 20:07:56 +0200 +Subject: [PATCH] Upgrade Visual studio 2017 15.8 + +- Upgrade to 15.8 +- Add check on CGATS memory allocation (thanks to Quang Nguyen for +pointing out this) +--- + Projects/VC2017/jpegicc/jpegicc.vcxproj | 1 + + Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj | 2 +- + Projects/VC2017/lcms2_static/lcms2_static.vcxproj | 2 +- + Projects/VC2017/linkicc/linkicc.vcxproj | 2 +- + Projects/VC2017/psicc/psicc.vcxproj | 2 +- + Projects/VC2017/testbed/testbed.vcxproj | 2 +- + Projects/VC2017/tiffdiff/tiffdiff.vcxproj | 2 +- + Projects/VC2017/tifficc/tifficc.vcxproj | 2 +- + Projects/VC2017/transicc/transicc.vcxproj | 1 + + src/cmscgats.c | 14 ++++++++++---- + 10 files changed, 19 insertions(+), 11 deletions(-) + +diff --git a/Projects/VC2017/jpegicc/jpegicc.vcxproj b/Projects/VC2017/jpegicc/jpegicc.vcxproj +index ab26a53..39cfd00 100644 +--- a/Projects/VC2017/jpegicc/jpegicc.vcxproj ++++ b/Projects/VC2017/jpegicc/jpegicc.vcxproj +@@ -22,6 +22,7 @@ + <ProjectGuid>{62812507-F926-4968-96A9-17678460AD90}</ProjectGuid> + <RootNamespace>jpegicc</RootNamespace> + <Keyword>Win32Proj</Keyword> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj +index 4c8aa3f..d1bf3eb 100644 +--- a/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj ++++ b/Projects/VC2017/lcms2_DLL/lcms2_DLL.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{8C51BE48-ADB8-4089-A9EC-F6BF993A0548}</ProjectGuid> + <RootNamespace>lcms2_DLL</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj +index 2a9988a..9fc05ce 100644 +--- a/Projects/VC2017/lcms2_static/lcms2_static.vcxproj ++++ b/Projects/VC2017/lcms2_static/lcms2_static.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{71DEDE59-3F1E-486B-A899-4283000F76B5}</ProjectGuid> + <RootNamespace>lcms2_static</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/linkicc/linkicc.vcxproj b/Projects/VC2017/linkicc/linkicc.vcxproj +index 30c2b4e..51586dd 100644 +--- a/Projects/VC2017/linkicc/linkicc.vcxproj ++++ b/Projects/VC2017/linkicc/linkicc.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{FBFBE1DC-DB84-4BA1-9552-B4780F457849}</ProjectGuid> + <RootNamespace>linkicc</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/psicc/psicc.vcxproj b/Projects/VC2017/psicc/psicc.vcxproj +index 9dcf89a..8f26e12 100644 +--- a/Projects/VC2017/psicc/psicc.vcxproj ++++ b/Projects/VC2017/psicc/psicc.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{EF6A8851-65FE-46F5-B9EF-14F0B671F693}</ProjectGuid> + <RootNamespace>psicc</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/testbed/testbed.vcxproj b/Projects/VC2017/testbed/testbed.vcxproj +index 0af3762..3f6aea3 100644 +--- a/Projects/VC2017/testbed/testbed.vcxproj ++++ b/Projects/VC2017/testbed/testbed.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{928A3A2B-46EF-4279-959C-513B3652FF0E}</ProjectGuid> + <RootNamespace>testbed</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj +index 7edfe28..3a6d837 100644 +--- a/Projects/VC2017/tiffdiff/tiffdiff.vcxproj ++++ b/Projects/VC2017/tiffdiff/tiffdiff.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{75B91835-CCD7-48BE-A606-A9C997D5DBEE}</ProjectGuid> + <RootNamespace>tiffdiff</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/tifficc/tifficc.vcxproj b/Projects/VC2017/tifficc/tifficc.vcxproj +index cd9f04c..5ef954f 100644 +--- a/Projects/VC2017/tifficc/tifficc.vcxproj ++++ b/Projects/VC2017/tifficc/tifficc.vcxproj +@@ -22,7 +22,7 @@ + <ProjectGuid>{2256DE16-ED92-4A6F-9C54-F65BB61E64A2}</ProjectGuid> + <RootNamespace>tifficc</RootNamespace> + <Keyword>Win32Proj</Keyword> +- <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/Projects/VC2017/transicc/transicc.vcxproj b/Projects/VC2017/transicc/transicc.vcxproj +index d9b77c6..b3173d8 100644 +--- a/Projects/VC2017/transicc/transicc.vcxproj ++++ b/Projects/VC2017/transicc/transicc.vcxproj +@@ -22,6 +22,7 @@ + <ProjectGuid>{9EE22D66-C849-474C-9ED5-C3E141DAB160}</ProjectGuid> + <RootNamespace>transicc</RootNamespace> + <Keyword>Win32Proj</Keyword> ++ <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> +diff --git a/src/cmscgats.c b/src/cmscgats.c +index 1a87613..8c3e96d 100644 +--- a/src/cmscgats.c ++++ b/src/cmscgats.c +@@ -1,7 +1,7 @@ + //--------------------------------------------------------------------------------- + // + // Little Color Management System +-// Copyright (c) 1998-2017 Marti Maria Saguer ++// Copyright (c) 1998-2018 Marti Maria Saguer + // + // Permission is hereby granted, free of charge, to any person obtaining + // a copy of this software and associated documentation files (the "Software"), +@@ -1506,10 +1506,16 @@ void AllocateDataSet(cmsIT8* it8) + t-> nSamples = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS")); + t-> nPatches = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS")); + +- t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*)); +- if (t->Data == NULL) { ++ if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe) ++ { ++ SynError(it8, "AllocateDataSet: too much data"); ++ } ++ else { ++ t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*)); ++ if (t->Data == NULL) { + +- SynError(it8, "AllocateDataSet: Unable to allocate data array"); ++ SynError(it8, "AllocateDataSet: Unable to allocate data array"); ++ } + } + + } |