diff options
| author |   Lee Chee Yang <chee.yang.lee@intel.com> | 2023-12-05 10:15:51 +0800 |
|---|---|---|
| committer |   Steve Sakoman <steve@sakoman.com> | 2023-12-06 04:16:56 -1000 |
| commit | 507b9de9df375721cd307163fe06c3ee567385e8 (patch) | |
| tree | b2d6566ee80892e3be63d2bb4d8a973671223433 | |
| parent | f9cc32ed3c67c8fe60debbc23b579e120038b2e9 (diff) | |
| download | openembedded-core-contrib-507b9de9df375721cd307163fe06c3ee567385e8.tar.gz | |
epiphany: fix CVE-2022-29536
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
| -rw-r--r-- | meta/recipes-gnome/epiphany/epiphany_3.34.4.bb | 1 | ||||
| -rw-r--r-- | meta/recipes-gnome/epiphany/files/CVE-2022-29536.patch | 46 |
2 files changed, 47 insertions, 0 deletions
diff --git a/meta/recipes-gnome/epiphany/epiphany_3.34.4.bb b/meta/recipes-gnome/epiphany/epiphany_3.34.4.bb index e2afb29c12..f43bfd6a67 100644 --- a/meta/recipes-gnome/epiphany/epiphany_3.34.4.bb +++ b/meta/recipes-gnome/epiphany/epiphany_3.34.4.bb @@ -16,6 +16,7 @@ REQUIRED_DISTRO_FEATURES = "x11 opengl" SRC_URI = "${GNOME_MIRROR}/${GNOMEBN}/${@gnome_verdir("${PV}")}/${GNOMEBN}-${PV}.tar.${GNOME_COMPRESS_TYPE};name=archive \ file://0002-help-meson.build-disable-the-use-of-yelp.patch \ + file://CVE-2022-29536.patch \ " SRC_URI[archive.md5sum] = "a559f164bb7d6cbeceb348648076830b" SRC_URI[archive.sha256sum] = "60e190fc07ec7e33472e60c7e633e04004f7e277a0ffc5e9cd413706881e598d" diff --git a/meta/recipes-gnome/epiphany/files/CVE-2022-29536.patch b/meta/recipes-gnome/epiphany/files/CVE-2022-29536.patch new file mode 100644 index 0000000000..71cfc1238a --- /dev/null +++ b/meta/recipes-gnome/epiphany/files/CVE-2022-29536.patch @@ -0,0 +1,46 @@ +CVE: CVE-2022-29536 +Upstream-Status: Backport [ https://gitlab.gnome.org/GNOME/epiphany/-/commit/486da133569ebfc436c959a7419565ab102e8525 ] +Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> + +From 486da133569ebfc436c959a7419565ab102e8525 Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro <mcatanzaro@redhat.com> +Date: Fri, 15 Apr 2022 18:09:46 -0500 +Subject: [PATCH] Fix memory corruption in ephy_string_shorten() + +This fixes a regression that I introduced in 232c613472b38ff0d0d97338f366024ddb9cd228. + +I got my browser stuck in a crash loop today while visiting a website +with a page title greater than ephy-embed.c's MAX_TITLE_LENGTH, the only +condition in which ephy_string_shorten() is ever used. Turns out this +commit is wrong: an ellipses is a multibyte character (three bytes in +UTF-8) and so we're writing past the end of the buffer when calling +strcat() here. Ooops. + +Shame it took nearly four years to notice and correct this. + +Part-of: <https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1106> +--- + lib/ephy-string.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/lib/ephy-string.c b/lib/ephy-string.c +index 35a148ab32..8e524d52ca 100644 +--- a/lib/ephy-string.c ++++ b/lib/ephy-string.c +@@ -114,11 +114,10 @@ ephy_string_shorten (char *str, + /* create string */ + bytes = GPOINTER_TO_UINT (g_utf8_offset_to_pointer (str, target_length - 1) - str); + +- /* +1 for ellipsis, +1 for trailing NUL */ +- new_str = g_new (gchar, bytes + 1 + 1); ++ new_str = g_new (gchar, bytes + strlen ("…") + 1); + + strncpy (new_str, str, bytes); +- strcat (new_str, "…"); ++ strncpy (new_str + bytes, "…", strlen ("…") + 1); + + g_free (str); + +-- +GitLab + |