Compare commits
1 commit
| Author | SHA1 | Date | |
|---|---|---|---|
|
48dd2f7ff4 |
2 changed files with 119 additions and 1 deletions
112
fontconfig-validate-offset-in-cache.patch
Normal file
112
fontconfig-validate-offset-in-cache.patch
Normal file
|
|
@ -0,0 +1,112 @@
|
|||
diff -pruN fontconfig-2.11.94.orig/src/fccache.c fontconfig-2.11.94/src/fccache.c
|
||||
--- fontconfig-2.11.94.orig/src/fccache.c 2016-08-05 20:07:43.053872110 +0900
|
||||
+++ fontconfig-2.11.94/src/fccache.c 2016-08-05 20:09:35.819872110 +0900
|
||||
@@ -27,6 +27,7 @@
|
||||
#include <fcntl.h>
|
||||
#include <dirent.h>
|
||||
#include <string.h>
|
||||
+#include <limits.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <assert.h>
|
||||
@@ -611,6 +612,82 @@ bail:
|
||||
return ret;
|
||||
}
|
||||
|
||||
+static FcBool
|
||||
+FcCacheOffsetsValid (FcCache *cache)
|
||||
+{
|
||||
+ char *base = (char *)cache;
|
||||
+ char *end = base + cache->size;
|
||||
+ intptr_t *dirs;
|
||||
+ FcFontSet *fs;
|
||||
+ int i, j;
|
||||
+
|
||||
+ if (cache->dir < 0 || cache->dir > cache->size - sizeof (intptr_t) ||
|
||||
+ memchr (base + cache->dir, '\0', cache->size - cache->dir) == NULL)
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ if (cache->dirs < 0 || cache->dirs >= cache->size ||
|
||||
+ cache->dirs_count < 0 ||
|
||||
+ cache->dirs_count > (cache->size - cache->dirs) / sizeof (intptr_t))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ dirs = FcCacheDirs (cache);
|
||||
+ if (dirs)
|
||||
+ {
|
||||
+ for (i = 0; i < cache->dirs_count; i++)
|
||||
+ {
|
||||
+ FcChar8 *dir;
|
||||
+
|
||||
+ if (dirs[i] < 0 ||
|
||||
+ dirs[i] > end - (char *) dirs - sizeof (intptr_t))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ dir = FcOffsetToPtr (dirs, dirs[i], FcChar8);
|
||||
+ if (memchr (dir, '\0', end - (char *) dir) == NULL)
|
||||
+ return FcFalse;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (cache->set < 0 || cache->set > cache->size - sizeof (FcFontSet))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ fs = FcCacheSet (cache);
|
||||
+ if (fs)
|
||||
+ {
|
||||
+ if (fs->nfont > (end - (char *) fs) / sizeof (FcPattern))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ if (fs->fonts != 0 && !FcIsEncodedOffset(fs->fonts))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ for (i = 0; i < fs->nfont; i++)
|
||||
+ {
|
||||
+ FcPattern *font = FcFontSetFont (fs, i);
|
||||
+ FcPatternElt *e;
|
||||
+ FcValueListPtr l;
|
||||
+
|
||||
+ if ((char *) font < base ||
|
||||
+ (char *) font > end - sizeof (FcFontSet) ||
|
||||
+ font->elts_offset < 0 ||
|
||||
+ font->elts_offset > end - (char *) font ||
|
||||
+ font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+
|
||||
+ e = FcPatternElts(font);
|
||||
+ if (e->values != 0 && !FcIsEncodedOffset(e->values))
|
||||
+ return FcFalse;
|
||||
+
|
||||
+ for (j = font->num, l = FcPatternEltValues(e); j >= 0 && l; j--, l = FcValueListNext(l))
|
||||
+ if (l->next != NULL && !FcIsEncodedOffset(l->next))
|
||||
+ break;
|
||||
+ if (j < 0)
|
||||
+ return FcFalse;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ return FcTrue;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Map a cache file into memory
|
||||
*/
|
||||
@@ -620,7 +697,8 @@ FcDirCacheMapFd (FcConfig *config, int f
|
||||
FcCache *cache;
|
||||
FcBool allocated = FcFalse;
|
||||
|
||||
- if (fd_stat->st_size < (int) sizeof (FcCache))
|
||||
+ if (fd_stat->st_size > INTPTR_MAX ||
|
||||
+ fd_stat->st_size < (int) sizeof (FcCache))
|
||||
return NULL;
|
||||
cache = FcCacheFindByStat (fd_stat);
|
||||
if (cache)
|
||||
@@ -677,6 +755,7 @@ FcDirCacheMapFd (FcConfig *config, int f
|
||||
if (cache->magic != FC_CACHE_MAGIC_MMAP ||
|
||||
cache->version < FC_CACHE_VERSION_NUMBER ||
|
||||
cache->size != (intptr_t) fd_stat->st_size ||
|
||||
+ !FcCacheOffsetsValid (cache) ||
|
||||
!FcCacheTimeValid (config, cache, dir_stat) ||
|
||||
!FcCacheDirsValid (config, cache) ||
|
||||
!FcCacheInsert (cache, fd_stat))
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
Summary: Font configuration and customization library
|
||||
Name: fontconfig
|
||||
Version: 2.11.94
|
||||
Release: 4%{?dist}
|
||||
Release: 5%{?dist}
|
||||
# src/ftglue.[ch] is in Public Domain
|
||||
# src/fccache.c contains Public Domain code
|
||||
# fc-case/CaseFolding.txt is in the UCD
|
||||
|
|
@ -18,6 +18,8 @@ Source1: 25-no-bitmap-fedora.conf
|
|||
Patch0: %{name}-sleep-less.patch
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1236034
|
||||
Patch1: %{name}-lock-cache.patch
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1364439
|
||||
Patch2: %{name}-validate-offset-in-cache.patch
|
||||
|
||||
BuildRequires: expat-devel
|
||||
BuildRequires: freetype-devel >= %{freetype_version}
|
||||
|
|
@ -62,6 +64,7 @@ which is useful for developing applications that uses fontconfig.
|
|||
%setup -q
|
||||
%patch0 -p1 -b .sleep-less
|
||||
%patch1 -p1 -b .lock-cache
|
||||
%patch2 -p1 -b .validate-offset
|
||||
|
||||
%build
|
||||
# We don't want to rebuild the docs, but we want to install the included ones.
|
||||
|
|
@ -138,6 +141,9 @@ fi
|
|||
%doc fontconfig-devel.txt fontconfig-devel
|
||||
|
||||
%changelog
|
||||
* Fri Aug 5 2016 Akira TAGOH <tagoh@redhat.com> - 2.11.94-5
|
||||
- CVE-2016-5384: Validate offsets in cache files properly. (#1364439)
|
||||
|
||||
* Fri Aug 14 2015 Akira TAGOH <tagoh@redhat.com> - 2.11.94-4
|
||||
- Revise the patch. (#1236034)
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue