mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
4bfacb70ab
Fixes the following vulnerabilities:
- CVE-2018-6952:
A double free exists in the another_hunk function in pch.c in GNU
patch through 2.7.6.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2018-6952
- https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706262bf204d6e03322c300
- CVE-2019-20633:
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free
vulnerability in the function another_hunk in pch.c that can cause a
denial of service via a crafted patch file. NOTE: this issue exists
because of an incomplete fix for CVE-2018-6952.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-20633
- https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=15b158db3ae11cb835f2eb8d2eb48e09d1a4af48
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b28f9363c5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
34 lines
1.0 KiB
Diff
34 lines
1.0 KiB
Diff
From 9c986353e420ead6e706262bf204d6e03322c300 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Gruenbacher <agruen@gnu.org>
|
|
Date: Fri, 17 Aug 2018 13:35:40 +0200
|
|
Subject: Fix swapping fake lines in pch_swap
|
|
|
|
* src/pch.c (pch_swap): Fix swapping p_bfake and p_efake when there is a
|
|
blank line in the middle of a context-diff hunk: that empty line stays
|
|
in the middle of the hunk and isn't swapped.
|
|
|
|
Fixes: https://savannah.gnu.org/bugs/index.php?53133
|
|
CVE: CVE-2018-6952
|
|
Upstream: https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706262bf204d6e03322c300
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/pch.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/pch.c b/src/pch.c
|
|
index e92bc64..a500ad9 100644
|
|
--- a/src/pch.c
|
|
+++ b/src/pch.c
|
|
@@ -2115,7 +2115,7 @@ pch_swap (void)
|
|
}
|
|
if (p_efake >= 0) { /* fix non-freeable ptr range */
|
|
if (p_efake <= i)
|
|
- n = p_end - i + 1;
|
|
+ n = p_end - p_ptrn_lines;
|
|
else
|
|
n = -i;
|
|
p_efake += n;
|
|
--
|
|
cgit v1.2.3
|
|
|