← Back to branch summary

~ubuntu-branches/ubuntu/hardy/libexif/hardy

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2007-6352.dpatch

  • Committer: Bazaar Package Importer
  • Author(s): Nico Golde
  • Date: 2007-12-21 17:13:58 UTC
  • mfrom: (5.1.5 hardy)
  • Revision ID: james.westby@ubuntu.com-20071221171358-zbjzk21kmnizelhk
Tags: 0.6.16-2.1
http://bugs.debian.org/457330
http://bugs.debian.org/457330
* Non-maintainer upload by security team.
* This update addresses the following security issues:
  - possible denial of service attack via crafted
    image file leading to an infinite recursion in the
    exif-loader.c (CVE-2007-6351; Closes: #457330).
  - integer overflow in exif-data.c triggered by a crafted
    image file could lead to arbitrary code execution
    (CVE-2007-6352; Closes: #457330).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2007-6352.dpatch
 
1
#! /bin/sh /usr/share/dpatch/dpatch-run
 
2
## CVE-2007-6352.dpatch by Nico Golde <nion@debian.org>
 
3
##
 
4
## All lines beginning with `## DP:' are a description of the patch.
 
5
## DP: No description.
 
6
 
 
7
@DPATCH@
 
8
diff -urNad libexif-0.6.16~/libexif/exif-data.c libexif-0.6.16/libexif/exif-data.c
 
9
--- libexif-0.6.16~/libexif/exif-data.c 2007-06-12 15:01:54.000000000 +0200
 
10
+++ libexif-0.6.16/libexif/exif-data.c  2007-12-21 17:13:15.000000000 +0100
 
11
@@ -288,10 +288,9 @@
 
12
 exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
 
13
                               unsigned int ds, ExifLong offset, ExifLong size)
 
14
 {
 
15
-       if (ds < offset + size) {
 
16
+       if (ds < offset + size || (offset < 0) || (size < 0) || (offset + size < offset)) {
 
17
                exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
 
18
-                         "Bogus thumbnail offset and size: %i < %i + %i.",
 
19
-                         (int) ds, (int) offset, (int) size);
 
20
+                         "Bogus thumbnail offset and size");
 
21
                return;
 
22
        }
 
23
        if (data->data)