|
 |
96aea1 |
From 487f4136013d9fa3351b863e5f861463a1cbddcf Mon Sep 17 00:00:00 2001
|
|
|
96aea1 |
From: Victor Rodriguez <victor.rodriguez.bahena@intel.com>
|
|
|
96aea1 |
Date: Sat, 18 Aug 2018 13:54:55 +0000
|
|
|
96aea1 |
Subject: [PATCH] Issue #9 - Fix null-pointer-dereference (CVE-2018-12648)
|
|
|
96aea1 |
MIME-Version: 1.0
|
|
|
96aea1 |
Content-Type: text/plain; charset=UTF-8
|
|
|
96aea1 |
Content-Transfer-Encoding: 8bit
|
|
|
96aea1 |
|
|
|
96aea1 |
The WEBP::GetLE32 function in
|
|
|
96aea1 |
XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a
|
|
|
96aea1 |
NULL pointer dereference.
|
|
|
96aea1 |
|
|
|
96aea1 |
https://bugs.freedesktop.org/show_bug.cgi?id=106981
|
|
|
96aea1 |
https://gitlab.freedesktop.org/libopenraw/exempi/issues/9
|
|
|
96aea1 |
|
|
|
96aea1 |
Signed-off-by: Victor Rodriguez <victor.rodriguez.bahena@intel.com>
|
|
|
96aea1 |
Signed-off-by: Hubert Figuière <hub@figuiere.net>
|
|
|
96aea1 |
---
|
|
|
96aea1 |
XMPFiles/source/FormatSupport/WEBP_Support.cpp | 8 +++++---
|
|
|
96aea1 |
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
96aea1 |
|
|
|
96aea1 |
diff --git a/XMPFiles/source/FormatSupport/WEBP_Support.cpp b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
|
|
|
96aea1 |
index ffaf220..4fe705b 100644
|
|
|
96aea1 |
--- a/XMPFiles/source/FormatSupport/WEBP_Support.cpp
|
|
|
96aea1 |
+++ b/XMPFiles/source/FormatSupport/WEBP_Support.cpp
|
|
|
96aea1 |
@@ -160,9 +160,11 @@ bool VP8XChunk::xmp()
|
|
|
96aea1 |
}
|
|
|
96aea1 |
void VP8XChunk::xmp(bool hasXMP)
|
|
|
96aea1 |
{
|
|
|
96aea1 |
- XMP_Uns32 flags = GetLE32(&this->data[0]);
|
|
|
96aea1 |
- flags ^= (-hasXMP ^ flags) & (1 << XMP_FLAG_BIT);
|
|
|
96aea1 |
- PutLE32(&this->data[0], flags);
|
|
|
96aea1 |
+ if (&this->data[0] != NULL) {
|
|
|
96aea1 |
+ XMP_Uns32 flags = GetLE32(&this->data[0]);
|
|
|
96aea1 |
+ flags ^= (-hasXMP ^ flags) & (1 << XMP_FLAG_BIT);
|
|
|
96aea1 |
+ PutLE32(&this->data[0], flags);
|
|
|
96aea1 |
+ }
|
|
|
96aea1 |
}
|
|
|
96aea1 |
|
|
|
96aea1 |
Container::Container(WEBP_MetaHandler* handler) : Chunk(NULL, handler)
|
|
|
96aea1 |
--
|
|
|
96aea1 |
2.17.1
|
|
|
96aea1 |
|