diff options
author | V3n3RiX <venerix@redcorelinux.org> | 2020-08-25 10:45:55 +0100 |
---|---|---|
committer | V3n3RiX <venerix@redcorelinux.org> | 2020-08-25 10:45:55 +0100 |
commit | 3cf7c3ef441822c889356fd1812ebf2944a59851 (patch) | |
tree | c513fe68548b40365c1c2ebfe35c58ad431cdd77 /sys-fs/fuseiso/files | |
parent | 05b8b0e0af1d72e51a3ee61522941bf7605cd01c (diff) |
gentoo resync : 25.08.2020
Diffstat (limited to 'sys-fs/fuseiso/files')
-rw-r--r-- | sys-fs/fuseiso/files/fuseiso-20070708-CVE-2015-8837.patch | 38 | ||||
-rw-r--r-- | sys-fs/fuseiso/files/fuseiso-20070708-integer-overflow.patch | 19 |
2 files changed, 57 insertions, 0 deletions
diff --git a/sys-fs/fuseiso/files/fuseiso-20070708-CVE-2015-8837.patch b/sys-fs/fuseiso/files/fuseiso-20070708-CVE-2015-8837.patch new file mode 100644 index 000000000000..a5ab828ee637 --- /dev/null +++ b/sys-fs/fuseiso/files/fuseiso-20070708-CVE-2015-8837.patch @@ -0,0 +1,38 @@ +https://sources.debian.org/patches/fuseiso/20070708-3.2/02-prevent-buffer-overflow.patch/ +https://bugs.gentoo.org/713328 +---- +Description: Prevent stack-based buffer overflow on too-long path names +Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> + +--- a/src/isofs.c ++++ b/src/isofs.c +@@ -1532,13 +1532,23 @@ + if(path[1] != '\0') { // not root dir + strcat(absolute_entry, "/"); + }; +- strcat(absolute_entry, entry); +- if(g_hash_table_lookup(lookup_table, absolute_entry)) { +- // already in lookup cache ++ ++ if(strlen(absolute_entry) + strlen(entry) <= PATH_MAX-1) { ++ strcat(absolute_entry, entry); ++ if(g_hash_table_lookup(lookup_table, absolute_entry)) { ++ // already in lookup cache ++ isofs_free_inode(inode); ++ } else { ++ g_hash_table_insert(lookup_table, g_strdup(absolute_entry), inode); ++ }; ++ } ++ else { ++ printf("readdir: absolute path name for entry '%s' exceeding PATH_MAX (%d)\n", entry, PATH_MAX); + isofs_free_inode(inode); +- } else { +- g_hash_table_insert(lookup_table, g_strdup(absolute_entry), inode); +- }; ++ free(buf); ++ free(entry); ++ return -EIO; ++ } + + free(entry); + diff --git a/sys-fs/fuseiso/files/fuseiso-20070708-integer-overflow.patch b/sys-fs/fuseiso/files/fuseiso-20070708-integer-overflow.patch new file mode 100644 index 000000000000..9f20b9b8c51e --- /dev/null +++ b/sys-fs/fuseiso/files/fuseiso-20070708-integer-overflow.patch @@ -0,0 +1,19 @@ +https://sources.debian.org/patches/fuseiso/20070708-3.2/03-prevent-integer-overflow.patch/ +https://bugs.gentoo.org/713328 +---- +Description: Prevent integer overflow in ZISO code +Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> + +--- a/src/isofs.c ++++ b/src/isofs.c +@@ -1618,6 +1618,10 @@ + }; + + static int isofs_real_read_zf(isofs_inode *inode, char *out_buf, size_t size, off_t offset) { ++ if( inode->zf_block_shift > 17 ) { ++ fprintf(stderr, "isofs_real_read_zf: can't handle ZF block size of 2^%d\n", inode->zf_block_shift); ++ return -EIO; ++ } + int zf_block_size = 1 << inode->zf_block_shift; + int zf_start = offset / zf_block_size; + int zf_end = (offset + size) / zf_block_size; |