mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
fed0532cb8
Add an upstream patch to fix CVE-2020-35492: A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's image-compositor (for example, by convincing a user to open a file in an application using cairo, or if an application uses cairo on untrusted input) to cause a stack buffer overflow -> out-of-bounds WRITE. The highest impact from this vulnerability is to confidentiality, integrity, as well as system availability. Important note: this is not the exact upstream patch. Indeed, the upstream patch[1] contains a png file which appears as a binary diff inside the patch. The `patch` tool which is used by Buildroot to apply patches does not handle that kind of diff. Since it is just a test, it shouldn't impact the quality of the CVE fix and all changes related to the test are removed from the patch. [1]03a820b173Cc: Quentin Schulz <foss+buildroot@0leil.net> Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit111ab56d84) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>