Blame SOURCES/0001-Fix-CVE-2022-46285-Infinite-loop-on-unclosed-comment.patch
|
 |
2824cf |
From ec75b3393506a6f71a477ac3982b31a48a42c196 Mon Sep 17 00:00:00 2001
|
|
|
2824cf |
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
2824cf |
Date: Sat, 17 Dec 2022 12:23:45 -0800
|
|
|
2824cf |
Subject: [PATCH libXpm 1/5] Fix CVE-2022-46285: Infinite loop on unclosed
|
|
|
2824cf |
comments
|
|
|
2824cf |
|
|
|
2824cf |
When reading XPM images from a file with libXpm 3.5.14 or older, if a
|
|
|
2824cf |
comment in the file is not closed (i.e. a C-style comment starts with
|
|
|
2824cf |
"/*" and is missing the closing "*/"), the ParseComment() function will
|
|
|
2824cf |
loop forever calling getc() to try to read the rest of the comment,
|
|
|
2824cf |
failing to notice that it has returned EOF, which may cause a denial of
|
|
|
2824cf |
service to the calling program.
|
|
|
2824cf |
|
|
|
2824cf |
Reported-by: Marco Ivaldi <raptor@0xdeadbeef.info>
|
|
|
2824cf |
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
2824cf |
---
|
|
|
2824cf |
src/data.c | 4 ++++
|
|
|
2824cf |
1 file changed, 4 insertions(+)
|
|
|
2824cf |
|
|
|
2824cf |
diff --git a/src/data.c b/src/data.c
|
|
|
2824cf |
index 898889c..bfad4ff 100644
|
|
|
2824cf |
--- a/src/data.c
|
|
|
2824cf |
+++ b/src/data.c
|
|
|
2824cf |
@@ -174,6 +174,10 @@ ParseComment(xpmData *data)
|
|
|
2824cf |
notend = 0;
|
|
|
2824cf |
Ungetc(data, *s, file);
|
|
|
2824cf |
}
|
|
|
2824cf |
+ else if (c == EOF) {
|
|
|
2824cf |
+ /* hit end of file before the end of the comment */
|
|
|
2824cf |
+ return XpmFileInvalid;
|
|
|
2824cf |
+ }
|
|
|
2824cf |
}
|
|
|
2824cf |
return 0;
|
|
|
2824cf |
}
|
|
|
2824cf |
--
|
|
|
2824cf |
2.39.0
|
|
|
2824cf |
|