diff options
| author | Ørjan Malde <red@foxi.me> | 2023-02-21 22:22:21 +0100 |
|---|---|---|
| committer | Ørjan Malde <red@foxi.me> | 2023-02-21 22:22:21 +0100 |
| commit | ef80776d27dbc3914b43e6437c19dc2db4fbfbdc (patch) | |
| tree | ade0c6c01db21f08c9a640a96f7d0d96c261bde9 /patches/tar | |
| parent | 8857c4d642f6bd13b7bfe0876a2f526980115717 (diff) | |
| download | midipix_build-ef80776d27dbc3914b43e6437c19dc2db4fbfbdc.tar.bz2 midipix_build-ef80776d27dbc3914b43e6437c19dc2db4fbfbdc.tar.xz | |
patches/tar/CVE-2022-48303.patch: new patch
Signed-off-by: Ørjan Malde <red@foxi.me>
Diffstat (limited to 'patches/tar')
| -rw-r--r-- | patches/tar/CVE-2022-48303.patch | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/patches/tar/CVE-2022-48303.patch b/patches/tar/CVE-2022-48303.patch new file mode 100644 index 00000000..6dd068b9 --- /dev/null +++ b/patches/tar/CVE-2022-48303.patch @@ -0,0 +1,30 @@ +From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff <gray@gnu.org> +Date: Sat, 11 Feb 2023 11:57:39 +0200 +Subject: Fix boundary checking in base-256 decoder + +* src/list.c (from_header): Base-256 encoding is at least 2 bytes +long. +--- + src/list.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/list.c b/src/list.c +index 9fafc42..86bcfdd 100644 +--- a/src/list.c ++++ b/src/list.c +@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, + where++; + } + } +- else if (*where == '\200' /* positive base-256 */ +- || *where == '\377' /* negative base-256 */) ++ else if (where <= lim - 2 ++ && (*where == '\200' /* positive base-256 */ ++ || *where == '\377' /* negative base-256 */)) + { + /* Parse base-256 output. A nonnegative number N is + represented as (256**DIGS)/2 + N; a negative number -N is +-- +cgit v1.1 + |