0003-Fix-501-Uninitialized-read-in-gdImageCreateFromXbm-C.patch 1.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. From e13a342c079aeb73e31dfa19eaca119761bac3f3 Mon Sep 17 00:00:00 2001
  2. From: Jonas Meurer <jonas@freesources.org>
  3. Date: Tue, 11 Jun 2019 12:16:46 +0200
  4. Subject: [PATCH] Fix #501: Uninitialized read in gdImageCreateFromXbm
  5. (CVE-2019-11038)
  6. Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-11038
  7. Bug-Debian: https://bugs.debian.org/929821
  8. Bug: https://github.com/libgd/libgd/issues/501
  9. We have to ensure that `sscanf()` does indeed read a hex value here,
  10. and bail out otherwise.
  11. Original patch by Christoph M. Becker <cmbecker69@gmx.de> for PHP libgd ext.
  12. https://git.php.net/?p=php-src.git;a=commit;h=ed6dee9a198c904ad5e03113e58a2d2c200f5184
  13. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  14. ---
  15. src/gd_xbm.c | 6 +++++-
  16. 1 file changed, 5 insertions(+), 1 deletion(-)
  17. diff --git a/src/gd_xbm.c b/src/gd_xbm.c
  18. index 4ca41ac..cf0545e 100644
  19. --- a/src/gd_xbm.c
  20. +++ b/src/gd_xbm.c
  21. @@ -169,7 +169,11 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd)
  22. }
  23. h[3] = ch;
  24. }
  25. - sscanf(h, "%x", &b);
  26. + if (sscanf(h, "%x", &b) != 1) {
  27. + gd_error("invalid XBM");
  28. + gdImageDestroy(im);
  29. + return 0;
  30. + }
  31. for (bit = 1; bit <= max_bit; bit = bit << 1) {
  32. gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0);
  33. if (x == im->sx) {
  34. --
  35. 2.20.1