Compare commits
No commits in common. 'c9' and 'c8-beta' have entirely different histories.
@ -0,0 +1,32 @@
|
||||
From 2fa554b01ef6079a9b35df9332bdc4f139ed67e0 Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Sat, 29 Apr 2023 17:50:39 -0700
|
||||
Subject: [PATCH] Fix CVE-2023-43788: Out of bounds read in
|
||||
XpmCreateXpmImageFromBuffer
|
||||
|
||||
When the test case for CVE-2022-46285 was run with the Address Sanitizer
|
||||
enabled, it found an out-of-bounds read in ParseComment() when reading
|
||||
from a memory buffer instead of a file, as it continued to look for the
|
||||
closing comment marker past the end of the buffer.
|
||||
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
---
|
||||
lib/Xm/Xpmdata.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c
|
||||
index 7524e65..0b0f1f3 100644
|
||||
--- a/lib/Xm/Xpmdata.c
|
||||
+++ b/lib/Xm/Xpmdata.c
|
||||
@@ -108,7 +108,7 @@ ParseComment(xpmData *data)
|
||||
n++;
|
||||
s2++;
|
||||
} while (c == *s2 && *s2 != '\0' && c);
|
||||
- if (*s2 == '\0') {
|
||||
+ if (*s2 == '\0' || c == '\0') {
|
||||
/* this is the end of the comment */
|
||||
notend = 0;
|
||||
mdata->cptr--;
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,36 @@
|
||||
From 7e21cb63b9a1ca760a06cc4cd9b19bbc3fcd8f51 Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Sat, 29 Apr 2023 18:30:34 -0700
|
||||
Subject: [PATCH] Fix CVE-2023-43789: Out of bounds read on XPM with corrupted
|
||||
colormap
|
||||
|
||||
Found with clang's libfuzzer
|
||||
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
---
|
||||
lib/Xm/Xpmdata.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c
|
||||
index 0b0f1f3..6e87455 100644
|
||||
--- a/lib/Xm/Xpmdata.c
|
||||
+++ b/lib/Xm/Xpmdata.c
|
||||
@@ -259,13 +259,13 @@ xpmNextWord(
|
||||
int c;
|
||||
|
||||
if (!mdata->type || mdata->type == XPMBUFFER) {
|
||||
- while (isspace(c = *mdata->cptr) && c != mdata->Eos)
|
||||
+ while ((c = *mdata->cptr) && isspace(c) && (c != mdata->Eos))
|
||||
mdata->cptr++;
|
||||
do {
|
||||
c = *mdata->cptr++;
|
||||
*buf++ = c;
|
||||
n++;
|
||||
- } while (!isspace(c) && c != mdata->Eos && n < buflen);
|
||||
+ } while (c && !isspace(c) && (c != mdata->Eos) && (n < buflen));
|
||||
n--;
|
||||
mdata->cptr--;
|
||||
} else {
|
||||
--
|
||||
2.41.0
|
||||
|
||||
Loading…
Reference in new issue