From 1cec3462323717e063c98b6404e9c5c5ef037bdd Mon Sep 17 00:00:00 2001 From: Julien Lepiller Date: Thu, 3 Aug 2017 20:14:56 +0200 Subject: gnu: php: Update to 7.1.8. * gnu/packages/patches/gd-CVE-2017-7890.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it * gnu/packages/php.scm (php): Update to 7.1.8. --- gnu/packages/patches/gd-CVE-2017-7890.patch | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 gnu/packages/patches/gd-CVE-2017-7890.patch (limited to 'gnu/packages/patches') diff --git a/gnu/packages/patches/gd-CVE-2017-7890.patch b/gnu/packages/patches/gd-CVE-2017-7890.patch new file mode 100644 index 0000000000..66034c5703 --- /dev/null +++ b/gnu/packages/patches/gd-CVE-2017-7890.patch @@ -0,0 +1,30 @@ +From 99ba5c353373ed198f54af66fe4e355ebb96e363 Mon Sep 17 00:00:00 2001 +From: LEPILLER Julien +Date: Thu, 3 Aug 2017 17:04:17 +0200 +Subject: [PATCH] Fix #399: Buffer over-read into uninitialized memory. + +The stack allocated color map buffers were not zeroed before usage, and +so undefined palette indexes could cause information leakage. + +This is CVE-2017-7890. +--- + src/gd_gif_in.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c +index 008d1ec..c195448 100644 +--- a/src/gd_gif_in.c ++++ b/src/gd_gif_in.c +@@ -216,6 +216,9 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromGifCtx(gdIOCtxPtr fd) + + gdImagePtr im = 0; + ++ memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE); ++ memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE); ++ + if(!ReadOK(fd, buf, 6)) { + return 0; + } +-- +2.13.3 + -- cgit 1.4.1