aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMuminul Islam <misla011@fiu.edu>2019-10-29 10:47:23 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-10-30 13:47:05 +0000
commitfe2d5b0d56201110323911d206243fdcc7f80115 (patch)
tree34b41979c87290389c50d35c4c3597bf1bd6e13e
parent132fb930109f4930acfc8524bcc40faa3ba6d3d9 (diff)
downloadopenembedded-core-contrib-fe2d5b0d56201110323911d206243fdcc7f80115.tar.gz
openembedded-core-contrib-fe2d5b0d56201110323911d206243fdcc7f80115.tar.bz2
openembedded-core-contrib-fe2d5b0d56201110323911d206243fdcc7f80115.zip
libcroco: Fix two CVEs
CVE: CVE-2017-8834 CVE-2017-8871 Signed-off-by: Muminul Islam <muislam@microsoft.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch38
-rw-r--r--meta/recipes-support/libcroco/libcroco_0.6.12.bb1
2 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch b/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch
new file mode 100644
index 00000000000..cdfc9cf5e60
--- /dev/null
+++ b/meta/recipes-support/libcroco/libcroco/CVE-2017-8834_71.patch
@@ -0,0 +1,38 @@
+From 38bdf8e956218dd6a72942229cf39ef8e45dd28f Mon Sep 17 00:00:00 2001
+From: Mike Gorse <mgorse@alum.wpi.edu>
+Date: Thu, 2 May 2019 10:54:43 -0500
+Subject: [PATCH] cr_utils_read_char_from_utf8_buf: move past invalid UTF-8
+Reply-To: muislam@microsoft.com; Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+Otherwise, the offending character is never consumed, possibly leading
+to an infinite loop.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=782647
+
+CVE: CVE-2017-8834 CVE-2017-8871
+
+Upstream-Status: Backport
+
+Signed-off-by: Muminul Islam <muislam@microsoft.com>
+
+Upstream commit: https://bug782647.bugzilla-attachments.gnome.org/attachment.cgi?id=374219
+---
+ src/cr-utils.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cr-utils.c b/src/cr-utils.c
+index 2420cec..6cf4849 100644
+--- a/src/cr-utils.c
++++ b/src/cr-utils.c
+@@ -505,6 +505,7 @@ cr_utils_read_char_from_utf8_buf (const guchar * a_in,
+
+ } else {
+ /*BAD ENCODING */
++ nb_bytes_2_decode = 1;
+ goto end;
+ }
+
+--
+2.23.0
+
diff --git a/meta/recipes-support/libcroco/libcroco_0.6.12.bb b/meta/recipes-support/libcroco/libcroco_0.6.12.bb
index f95a583134c..85a120d80bb 100644
--- a/meta/recipes-support/libcroco/libcroco_0.6.12.bb
+++ b/meta/recipes-support/libcroco/libcroco_0.6.12.bb
@@ -18,6 +18,7 @@ inherit gnomebase gtk-doc binconfig-disabled
SRC_URI += "file://CVE-2017-7960.patch \
file://CVE-2017-7961.patch \
+ file://CVE-2017-8834_71.patch \
"
SRC_URI[archive.md5sum] = "bc0984fce078ba2ce29f9500c6b9ddce"