CVE-2014-3487.patch 884 B

12345678910111213141516171819202122232425
  1. made apply cleanly based on
  2. commit 93e063ee374b6a75729df9e7201fb511e47e259d
  3. Author: Christos Zoulas <christos@zoulas.com>
  4. Date: Mon Jun 9 13:04:37 2014 +0000
  5. Add missing check offset test (Francisco Alonso, Jan Kaluza at RedHat)
  6. diff --git a/src/cdf.c b/src/cdf.c
  7. index 0bfb31a..c258e82 100644
  8. --- a/src/cdf.c
  9. +++ b/src/cdf.c
  10. @@ -802,7 +802,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
  11. if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
  12. goto out;
  13. for (i = 0; i < sh.sh_properties; i++) {
  14. - size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
  15. + size_t tail = (i << 1) + 1;
  16. + if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
  17. + __LINE__) == -1)
  18. + goto out;
  19. + size_t ofs = CDF_GETUINT32(p, tail);
  20. q = (const uint8_t *)(const void *)
  21. ((const char *)(const void *)p + ofs
  22. - 2 * sizeof(uint32_t));