From 8f36c8e9eabc06e1fff740e149bbd5008e53fe18 Mon Sep 17 00:00:00 2001 From: Alex Vong Date: Mon, 31 Dec 2018 06:50:48 +0800 Subject: gnu: libextractor: Fix CVE-2018-{20430,20431}. * gnu/packages/patches/libextractor-CVE-2018-20430.patch, gnu/packages/patches/libextractor-CVE-2018-20431.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/gnunet.scm (libextractor)[source]: Use them. --- .../patches/libextractor-CVE-2018-20431.patch | 53 ++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 gnu/packages/patches/libextractor-CVE-2018-20431.patch (limited to 'gnu/packages/patches/libextractor-CVE-2018-20431.patch') diff --git a/gnu/packages/patches/libextractor-CVE-2018-20431.patch b/gnu/packages/patches/libextractor-CVE-2018-20431.patch new file mode 100644 index 0000000000..855c5ba64b --- /dev/null +++ b/gnu/packages/patches/libextractor-CVE-2018-20431.patch @@ -0,0 +1,53 @@ +Fix CVE-2018-20431: + +https://gnunet.org/bugs/view.php?id=5494 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20431 +https://security-tracker.debian.org/tracker/CVE-2018-20431 + +Patch copied from upstream source repository: + +https://gnunet.org/git/libextractor.git/commit/?id=489c4a540bb2c4744471441425b8932b97a153e7 + +To apply the patch to libextractor 1.8 release tarball, +hunk #1 which patches ChangeLog is removed. + +From 489c4a540bb2c4744471441425b8932b97a153e7 Mon Sep 17 00:00:00 2001 +From: Christian Grothoff +Date: Thu, 20 Dec 2018 23:02:28 +0100 +Subject: [PATCH] fix #5494 + +--- + ChangeLog | 3 ++- + src/plugins/ole2_extractor.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/src/plugins/ole2_extractor.c b/src/plugins/ole2_extractor.c +index 53fa1b9..a48b726 100644 +--- a/src/plugins/ole2_extractor.c ++++ b/src/plugins/ole2_extractor.c +@@ -173,7 +173,7 @@ struct ProcContext + EXTRACTOR_MetaDataProcessor proc; + + /** +- * Closure for 'proc'. ++ * Closure for @e proc. + */ + void *proc_cls; + +@@ -213,7 +213,12 @@ process_metadata (gpointer key, + + if (G_VALUE_TYPE(gval) == G_TYPE_STRING) + { +- contents = strdup (g_value_get_string (gval)); ++ const char *gvals; ++ ++ gvals = g_value_get_string (gval); ++ if (NULL == gvals) ++ return; ++ contents = strdup (gvals); + } + else + { +-- +2.20.1 + -- cgit 1.4.1