mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-27 20:40:34 -09:00
11f509d1d2
- CVE-2026-41254:
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in
cmslut.c because the overflow check is performed after the
multiplication.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-41254
- da6110b1d1
- e0641b1828
- CVE-2026-42798:
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer
overflow in ParseCube in cmscgats.c.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42798
- 6a68601982
(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
35 lines
1000 B
Diff
35 lines
1000 B
Diff
From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001
|
|
From: Marti Maria <marti.maria@littlecms.com>
|
|
Date: Thu, 12 Mar 2026 22:57:35 +0100
|
|
Subject: [PATCH] check for overflow
|
|
|
|
Thanks to Guanni Qu for detecting & reporting the issue
|
|
|
|
CVE: CVE-2026-41254
|
|
Upstream: https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/cmslut.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/cmslut.c b/src/cmslut.c
|
|
index a60baf98..65c935fc 100644
|
|
--- a/src/cmslut.c
|
|
+++ b/src/cmslut.c
|
|
@@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
|
|
for (rv = 1; b > 0; b--) {
|
|
|
|
dim = Dims[b-1];
|
|
- if (dim <= 1) return 0; // Error
|
|
-
|
|
- rv *= dim;
|
|
+ if (dim <= 1) return 0;
|
|
|
|
// Check for overflow
|
|
if (rv > UINT_MAX / dim) return 0;
|
|
+
|
|
+ rv *= dim;
|
|
}
|
|
|
|
// Again, prevent overflow
|