packages/indent
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!13 [sync] PR-9: Fix CVE-2023-40305

Browse Source 
From: @openeuler-sync-bot 
Reviewed-by: @caodongxia 
Signed-off-by: @caodongxia
This commit is contained in:
openeuler-ci-bot 2023-08-29 06:19:46 +00:00 committed by Gitee
commit f38b83a0aa
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
3 changed files with 42 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
fix-a-heap-buffer-overwrite-CVE-2023-40305.patch Normal file
View File

@ -0,0 +1,15 @@
From: Petr Písař <ppisar@redhat.com>
Subject: Fix a heap buffer overwrite in search_brace() (CVE-2023-40305)
Bug-Debian: https://bugs.debian.org/1049366
Forwarded: https://savannah.gnu.org/bugs/index.php?64503
--- a/src/indent.c
+++ b/src/indent.c
@@ -228,6 +228,7 @@
* a `dump_line' call, thus ensuring that the brace
* will go into the right column. */
+ need_chars (&save_com, 2);
*save_com.end++ = EOL;
*save_com.end++ = '{';
save_com.len += 2;

17
fix-an-out-of-buffer-read-CVE-2023-40305.patch Normal file
View File

@ -0,0 +1,17 @@
From: Petr Písař <ppisar@redhat.com>
Subject: Fix an out-of-buffer read in search_brace()/lexi()
Bug-Debian: https://bugs.debian.org/1049366
Forwarded: https://savannah.gnu.org/bugs/index.php?64503
--- a/src/indent.c
+++ b/src/indent.c
@@ -145,8 +145,8 @@
parser_state_tos->search_brace = false;
bp_save = buf_ptr;
be_save = buf_end;
- buf_ptr = save_com.ptr;
need_chars (&save_com, 1);
+ buf_ptr = save_com.ptr;
buf_end = save_com.end;
save_com.end = save_com.ptr; /* make save_com empty */
}

13
indent.spec
View File

@ -2,11 +2,10 @@
Name: indent
Summary: A tool to make code easier to read
Version: 2.2.11
Release: 27
Release: 29
License: GPLv3+
URL: http://www.gnu.org/software/%{name}/
Source: http://indent.isidore-it.eu/%{name}-%{version}.tar.gz
Source: http://ftp.gnu.org/gnu/indent/%{name}-%{version}.tar.gz
Patch5: indent-2.2.9-lcall.patch
Patch7: indent-2.2.9-man.patch
@ -19,6 +18,8 @@ Patch13: indent-2.2.11-Support-hexadecimal-floats.patch
Patch14: indent-2.2.11-Modernize-texi2html-arguments.patch
Patch15: indent-2.2.11-doc-Correct-a-typo-about-enabling-control-comment.patch
Patch16: indent-2.2.11-Fix-nbdfa-and-nbdfe-typo.patch
Patch17: fix-an-out-of-buffer-read-CVE-2023-40305.patch
Patch18: fix-a-heap-buffer-overwrite-CVE-2023-40305.patch
BuildRequires: gettext-devel automake gcc autoconf
BuildRequires: make coreutils gperf texinfo texi2html
@ -62,5 +63,11 @@ make -C regression
%exclude %{_infodir}/dir
%changelog
* Tue Aug 29 2023 wangkai <13474090681@163.com> - 2.2.11-29
- Fix CVE-2023-40305
* Thu Sep 10 2020 baizhonggui<baizhonggui@huawei.com> - 2.2.11-28
- fix source0
* Tue Dec 3 2019 caomeng<caomeng5@huawei.com> - 2.2.11-27
- Package init