git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: 9f4445eb2e
Branches Tags
file
/
debian
/
patches
/
CVE-2014-3480.patch

CVE-2014-3480.patch 1.1 KB
History Raw

1234567891011121314151617181920212223242526272829303132333435363738 
  1. Subject: The cdf_count_chain function does not properly validate sector-count data
    2. 

  2. ID: CVE-2014-3480
    3. 

  3. Author: Christos Zoulas <christos@zoulas.com>
    4. 

  4. Date: Wed Jun 4 17:23:19 2014 +0000
    5. 

  5. Origin:
    6. 

  6.     commit 40bade80cbe2af1d0b2cd0420cebd5d5905a2382
    7. 

  7. Debian-Author: Holger Levsen <holger@debian.org>
    8. 

  8. Comment:
    9. 

  9.  made apply cleanly based on [origin]
    10. 

  10. Reviewed-By: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
    11. 

  11. Last-Update: 2014-09-07
    12. 

  12. 

  13.     Fix incorrect bounds check for sector count. (Francisco Alonso and Jan Kaluza
    14. 

  14.     at RedHat)
    15. 

  15. 

  16. --- a/src/cdf.c
    17. 

  17. +++ b/src/cdf.c
    18. 

  18. @@ -460,7 +460,8 @@
    19. 

  19.  cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
    20. 

  20.  {
    21. 

  21.  	size_t i, j;
    22. 

  22. -	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
    23. 

  23. +	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
    24. 

  24. +	    / sizeof(maxsector));
    25. 

  25.  
    26. 

  26.  	DPRINTF(("Chain:"));
    27. 

  27.  	for (j = i = 0; sid >= 0; i++, j++) {
    28. 

  28. @@ -470,8 +471,8 @@
    29. 

  29.  			errno = EFTYPE;
    30. 

  30.  			return (size_t)-1;
    31. 

  31.  		}
    32. 

  32. -		if (sid > maxsector) {
    33. 

  33. -			DPRINTF(("Sector %d > %d\n", sid, maxsector));
    34. 

  34. +		if (sid >= maxsector) {
    35. 

  35. +			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
    36. 

  36.  			errno = EFTYPE;
    37. 

  37.  			return (size_t)-1;
    38. 

  38.  		}
    39.