diff options
| author |   Muminul Islam <misla011@fiu.edu> | 2019-10-21 20:50:15 +0000 |
|---|---|---|
| committer |   Armin Kuster <akuster808@gmail.com> | 2019-10-25 09:09:49 -0700 |
| commit | 08489df4ecb09666b11f8f308c97018791933326 (patch) | |
| tree | 17855c41a9625cd5d5cd786d92fae40f516c144e | |
| parent | 37d368b179eb9c07fb5e2f8496ee1036f4469b56 (diff) | |
| download | openembedded-core-contrib-08489df4ecb09666b11f8f308c97018791933326.tar.gz | |
libcroco: Fix two CVEs
CVE: CVE-2017-8834 CVE-2017-8871
Signed-off-by: Muminul Islam <muislam@microsoft.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
| -rw-r--r-- | meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch | 38 | ||||
| -rw-r--r-- | meta/recipes-support/libcroco/libcroco_0.6.12.bb | 1 |
2 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch b/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch new file mode 100644 index 0000000000..cdfc9cf5e6 --- /dev/null +++ b/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch @@ -0,0 +1,38 @@ +From 38bdf8e956218dd6a72942229cf39ef8e45dd28f Mon Sep 17 00:00:00 2001 +From: Mike Gorse <mgorse@alum.wpi.edu> +Date: Thu, 2 May 2019 10:54:43 -0500 +Subject: [PATCH] cr_utils_read_char_from_utf8_buf: move past invalid UTF-8 +Reply-To: muislam@microsoft.com; Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 8bit + +Otherwise, the offending character is never consumed, possibly leading +to an infinite loop. + +https://bugzilla.gnome.org/show_bug.cgi?id=782647 + +CVE: CVE-2017-8834 CVE-2017-8871 + +Upstream-Status: Backport + +Signed-off-by: Muminul Islam <muislam@microsoft.com> + +Upstream commit: https://bug782647.bugzilla-attachments.gnome.org/attachment.cgi?id=374219 +--- + src/cr-utils.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/cr-utils.c b/src/cr-utils.c +index 2420cec..6cf4849 100644 +--- a/src/cr-utils.c ++++ b/src/cr-utils.c +@@ -505,6 +505,7 @@ cr_utils_read_char_from_utf8_buf (const guchar * a_in, + + } else { + /*BAD ENCODING */ ++ nb_bytes_2_decode = 1; + goto end; + } + +-- +2.23.0 + diff --git a/meta/recipes-support/libcroco/libcroco_0.6.12.bb b/meta/recipes-support/libcroco/libcroco_0.6.12.bb index f95a583134..85a120d80b 100644 --- a/meta/recipes-support/libcroco/libcroco_0.6.12.bb +++ b/meta/recipes-support/libcroco/libcroco_0.6.12.bb @@ -18,6 +18,7 @@ inherit gnomebase gtk-doc binconfig-disabled SRC_URI += "file://CVE-2017-7960.patch \ file://CVE-2017-7961.patch \ + file://CVE-2017-8834_71.patch \ " SRC_URI[archive.md5sum] = "bc0984fce078ba2ce29f9500c6b9ddce" |