commit: 302b7d40ecbd4d456c0f39046a9c078c96e672d8 Author: Miroslav Šulc <fordfrog <AT> gentoo <DOT> org> AuthorDate: Thu Apr 29 07:55:33 2021 +0000 Commit: Miroslav Šulc <fordfrog <AT> gentoo <DOT> org> CommitDate: Thu Apr 29 07:55:49 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=302b7d40
media-libs/raptor: fixed CVE-2020-25713 Bug: https://bugs.gentoo.org/754264 Package-Manager: Portage-3.0.18, Repoman-3.0.3 Signed-off-by: Miroslav Šulc <fordfrog <AT> gentoo.org> ...713-raptor2-malformed-input-file-can-lead.patch | 32 ++++++++++++++++++++++ ...or-2.0.15-r2.ebuild => raptor-2.0.15-r3.ebuild} | 1 + 2 files changed, 33 insertions(+) diff --git a/media-libs/raptor/files/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch b/media-libs/raptor/files/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch new file mode 100644 index 00000000000..dc693dfec22 --- /dev/null +++ b/media-libs/raptor/files/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch @@ -0,0 +1,32 @@ +From a549457461874157c8c8e8e8a6e0eec06da4fbd0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <[email protected]> +Date: Tue, 24 Nov 2020 10:30:20 +0000 +Subject: [PATCH] CVE-2020-25713 raptor2: malformed input file can lead to a + segfault + +due to an out of bounds array access in +raptor_xml_writer_start_element_common + +See: +https://bugs.mageia.org/show_bug.cgi?id=27605 +https://www.openwall.com/lists/oss-security/2020/11/13/1 +https://gerrit.libreoffice.org/c/core/+/106249 +--- + src/raptor_xml_writer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c +index 56993dc3..4426d38c 100644 +--- a/src/raptor_xml_writer.c ++++ b/src/raptor_xml_writer.c +@@ -227,7 +227,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + + /* check it wasn't an earlier declaration too */ + for(j = 0; j < nspace_declarations_count; j++) +- if(nspace_declarations[j].nspace == element->attributes[j]->nspace) { ++ if(nspace_declarations[j].nspace == element->attributes[i]->nspace) { + declare_me = 0; + break; + } +-- +2.28.0 diff --git a/media-libs/raptor/raptor-2.0.15-r2.ebuild b/media-libs/raptor/raptor-2.0.15-r3.ebuild similarity index 95% rename from media-libs/raptor/raptor-2.0.15-r2.ebuild rename to media-libs/raptor/raptor-2.0.15-r3.ebuild index e2a831c9984..1f3f7e84c66 100644 --- a/media-libs/raptor/raptor-2.0.15-r2.ebuild +++ b/media-libs/raptor/raptor-2.0.15-r3.ebuild @@ -41,6 +41,7 @@ HTML_DOCS=( {NEWS,README,RELEASE,UPGRADING}.html ) PATCHES=( "${FILESDIR}/${P}-heap-overflow.patch" "${FILESDIR}/${P}-dont_use_curl-config.patch" #552474 + "${FILESDIR}/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch" ) src_prepare() {
