aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMikko Rapeli <mikko.rapeli@bmw.de>2021-01-15 12:54:37 +0200
committerArmin Kuster <akuster808@gmail.com>2021-01-28 17:17:52 -0800
commit4e6de3045c96fce9516311ba42911e209a1b84ba (patch)
tree1fa7be5ab44d9ef39e89804d33987924afd8699f
parentb5b2f97772780bea9fe10d358dab0807ffc6b1ad (diff)
downloadmeta-openembedded-contrib-4e6de3045c96fce9516311ba42911e209a1b84ba.tar.gz
meta-openembedded-contrib-4e6de3045c96fce9516311ba42911e209a1b84ba.tar.bz2
meta-openembedded-contrib-4e6de3045c96fce9516311ba42911e209a1b84ba.zip
giflib: apply patch for CVE-2019-15133 and set CVE_PRODUCT
Backport upstream patch for CVE-2019-15133. Set CVE_PRODUCT to "giflib_project:giflib" which is used in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133 Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch23
-rw-r--r--meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb7
2 files changed, 29 insertions, 1 deletions
diff --git a/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch b/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch
new file mode 100644
index 0000000000..9957be82f3
--- /dev/null
+++ b/meta-oe/recipes-devtools/giflib/files/CVE-2019-15133.patch
@@ -0,0 +1,23 @@
+From 799eb6a3af8a3dd81e2429bf11a72a57e541f908 Mon Sep 17 00:00:00 2001
+From: "Eric S. Raymond" <esr@thyrsus.com>
+Date: Sun, 17 Mar 2019 12:37:21 -0400
+Subject: [PATCH] Address SF bug #119: MemorySanitizer: FPE on unknown address
+
+---
+ dgif_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Upstream-status: Backport [https://sourceforge.net/p/giflib/code/ci/799eb6a3af8a3dd81e2429bf11a72a57e541f908/]
+CVE: CVE-2019-15133
+
+--- a/lib/dgif_lib.c 2021-01-13 19:28:18.923493586 +0100
++++ b/lib/dgif_lib.c 2021-01-13 19:28:55.245863085 +0100
+@@ -1099,7 +1099,7 @@ DGifSlurp(GifFileType *GifFile)
+
+ sp = &GifFile->SavedImages[GifFile->ImageCount - 1];
+ /* Allocate memory for the image */
+- if (sp->ImageDesc.Width < 0 && sp->ImageDesc.Height < 0 &&
++ if (sp->ImageDesc.Width <= 0 && sp->ImageDesc.Height <= 0 &&
+ sp->ImageDesc.Width > (INT_MAX / sp->ImageDesc.Height)) {
+ return GIF_ERROR;
+ }
diff --git a/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb b/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb
index 21fa352cdc..1871bab46e 100644
--- a/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb
+++ b/meta-oe/recipes-devtools/giflib/giflib_5.1.4.bb
@@ -3,7 +3,12 @@ SECTION = "libs"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=ae11c61b04b2917be39b11f78d71519a"
-SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.bz2"
+SRC_URI = " \
+ ${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.bz2 \
+ file://CVE-2019-15133.patch \
+"
+
+CVE_PRODUCT = "giflib_project:giflib"
inherit autotools