From 74253ffee576ea809f7eeb380647345a2ff910be Mon Sep 17 00:00:00 2001 From: Adam Duskett Date: Tue, 5 Dec 2023 16:59:18 -0700 Subject: [PATCH] package/giflib/0003-Fix-CVE-2023-39742.patch: New security patch Signed-off-by: Adam Duskett [yann.morin.1998@free.fr: extend GIFLIB_IGNORE_CVES] Signed-off-by: Yann E. MORIN --- package/giflib/0003-Fix-CVE-2023-39742.patch | 36 ++++++++++++++++++++ package/giflib/giflib.mk | 2 ++ 2 files changed, 38 insertions(+) create mode 100644 package/giflib/0003-Fix-CVE-2023-39742.patch diff --git a/package/giflib/0003-Fix-CVE-2023-39742.patch b/package/giflib/0003-Fix-CVE-2023-39742.patch new file mode 100644 index 0000000000..2ba01ac8a4 --- /dev/null +++ b/package/giflib/0003-Fix-CVE-2023-39742.patch @@ -0,0 +1,36 @@ +From 4288b993ee9df6550a367fe06ede3c003dc7bbc6 Mon Sep 17 00:00:00 2001 +From: Sandro Mani +Date: Tue, 5 Dec 2023 16:35:40 -0700 +Subject: [PATCH] Fix CVE-2023-39742 + +From: giflib-5.2.1-17.fc39.src.rpm +Fix segmentation faults due to non correct checking for args +Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-39742 +Upstream: https://sourceforge.net/p/giflib/bugs/166/ + +Signed-off-by: Sandro Mani +Signed-off-by: Adam Duskett +--- + getarg.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/getarg.c b/getarg.c +index d569f6c..51fbe0b 100644 +--- a/getarg.c ++++ b/getarg.c +@@ -307,6 +307,12 @@ GAGetParmeters(void *Parameters[], + int i = 0, ScanRes; + + while (!(ISSPACE(CtrlStrCopy[i]))) { ++ ++ if ((*argv) == argv_end) { ++ GAErrorToken = Option; ++ return CMD_ERR_NumRead; ++ } ++ + switch (CtrlStrCopy[i + 1]) { + case 'd': /* Get signed integers. */ + ScanRes = sscanf(*((*argv)++), "%d", +-- +2.43.0 + diff --git a/package/giflib/giflib.mk b/package/giflib/giflib.mk index 1207eafa16..d91c77e2ee 100644 --- a/package/giflib/giflib.mk +++ b/package/giflib/giflib.mk @@ -13,6 +13,8 @@ GIFLIB_CPE_ID_VENDOR = giflib_project # 0002-Fix-CVE-2022-28506.patch GIFLIB_IGNORE_CVES = CVE-2022-28506 +# 0003-Fix-CVE-2023-39742.patch +GIFLIB_IGNORE_CVES += CVE-2023-39742 ifeq ($(BR2_STATIC_LIBS),y) GIFLIB_BUILD_LIBS = static-lib