From c9b0cb493357e886673599b25f9bf80c38af955a Mon Sep 17 00:00:00 2001 From: zhouwenpei Date: Mon, 15 Jan 2024 06:28:49 +0000 Subject: [PATCH] fix CVE-2020-0452 (cherry picked from commit afef81fb7a1bfe1d0588c283e123979cac2743ad) --- backport-CVE-2020-0452.patch | 37 ++++++++++++++++++++++++++++++++++++ libexif.spec | 6 +++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2020-0452.patch diff --git a/backport-CVE-2020-0452.patch b/backport-CVE-2020-0452.patch new file mode 100644 index 0000000..dcd1254 --- /dev/null +++ b/backport-CVE-2020-0452.patch @@ -0,0 +1,37 @@ +Backported of: + +From 9266d14b5ca4e29b970fa03272318e5f99386e06 Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Thu, 5 Nov 2020 09:50:08 +0100 +Subject: [PATCH] fixed a incorrect overflow check that could be optimized + away. + +inspired by: +https://android.googlesource.com/platform/external/libexif/+/8e7345f3bc0bad06ac369d6cbc1124c8ceaf7d4b + +https://source.android.com/security/bulletin/2020-11-01 + +CVE-2020-0452 +Index: libexif-0.6.21/libexif/exif-entry.c +=================================================================== +--- libexif-0.6.21.orig/libexif/exif-entry.c ++++ libexif-0.6.21/libexif/exif-entry.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1376,8 +1377,8 @@ exif_entry_get_value (ExifEntry *e, char + case EXIF_TAG_XP_KEYWORDS: + case EXIF_TAG_XP_SUBJECT: + { +- /* Sanity check the size to prevent overflow */ +- if (e->size+sizeof(unsigned short) < e->size) break; ++ /* Sanity check the size to prevent overflow. Note EXIF files are 64kb at most. */ ++ if (e->size >= 65536 - sizeof(uint16_t)*2) break; + + /* The tag may not be U+0000-terminated , so make a local + U+0000-terminated copy before converting it */ diff --git a/libexif.spec b/libexif.spec index 601b094..7439020 100644 --- a/libexif.spec +++ b/libexif.spec @@ -1,7 +1,7 @@ Name: libexif Summary: Library for extracting extra information from image files Version: 0.6.21 -Release: 25 +Release: 26 License: LGPLv2+ URL: https://libexif.github.io/ Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.bz2 @@ -23,6 +23,7 @@ Patch6012: backport-CVE-2020-0181_CVE-2020-0198.patch Patch6013: backport-CVE-2020-0093.patch Patch6014: backport-fuzz-stack-overflow.patch Patch6015: backport-fuzz-timeout-and-out-of-memory.patch +Patch6016: backport-CVE-2020-0452.patch BuildRequires: autoconf automake doxygen gettext-devel libtool pkgconfig git @@ -80,6 +81,9 @@ make check %doc libexif-api.html NEWS %changelog +* Mon Jan 15 2024 zhouwenpei - 0.6.21-26 +- fix CVE-2020-0452 + * Tue Oct 18 2022 wangkerong - 0.6.21-25 - fix fuzz test error