From 9bb3e2046cdb45bafcbec8bd25e122fd80ad7db3 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 25 Oct 2023 11:05:02 -0400 Subject: [PATCH] stb_image: fix GHSL-2023-146 / fix CVE-2023-45662 --- 1541.patch | 25 +++++++++++++++++++++++++ stb.spec | 10 ++++++++++ 2 files changed, 35 insertions(+) create mode 100644 1541.patch diff --git a/1541.patch b/1541.patch new file mode 100644 index 0000000..9c3ce5d --- /dev/null +++ b/1541.patch @@ -0,0 +1,25 @@ +From 973cdc889deaae2b97d1bdf9b793b96be02b9b3c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= +Date: Thu, 19 Oct 2023 16:03:41 +0200 +Subject: [PATCH] Fix multi-byte read heap buffer overflow in + stbi__vertical_flip + +Fixes #1540 +--- + stb_image.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/stb_image.h b/stb_image.h +index 5e807a0a6..49c53d092 100644 +--- a/stb_image.h ++++ b/stb_image.h +@@ -1447,7 +1447,8 @@ STBIDEF stbi_uc *stbi_load_gif_from_memory(stbi_uc const *buffer, int len, int * + + result = (unsigned char*) stbi__load_gif_main(&s, delays, x, y, z, comp, req_comp); + if (stbi__vertically_flip_on_load) { +- stbi__vertical_flip_slices( result, *x, *y, *z, *comp ); ++ int channels = req_comp ? req_comp : *comp; ++ stbi__vertical_flip_slices( result, *x, *y, *z, channels ); + } + + return result; diff --git a/stb.spec b/stb.spec index a6fb018..a9f03fb 100644 --- a/stb.spec +++ b/stb.spec @@ -119,6 +119,16 @@ Patch: %{url}/pull/1534.patch # https://github.com/nothings/stb/issues/1538 Patch: %{url}/pull/1539.patch +# Fix multi-byte read heap buffer overflow in stbi__vertical_flip +# https://github.com/nothings/stb/pull/1541 +# +# Fixes: +# +# Multi-byte read heap buffer overflow in stbi__vertical_flip +# (GHSL-2023-146/CVE-2023-45662) +# https://github.com/nothings/stb/issues/1540 +Patch: %{url}/pull/1541.patch + %global stb_c_lexer_version 0.12 %global stb_connected_components_version 0.96 %global stb_divide_version 0.94