Wed Dec 23 14:21:48 2009 UTC ()
add a patch from
https://bugzilla.redhat.com/show_bug.cgi?id=543905
to fix CVE-2009-4227
(Stack-based buffer overflow by loading malformed .FIG files)
(drochner)
diff -r1.59 -r1.60 pkgsrc/graphics/xfig/Makefile
diff -r1.21 -r1.22 pkgsrc/graphics/xfig/distinfo
diff -r0 -r1.1 pkgsrc/graphics/xfig/patches/patch-an
--- pkgsrc/graphics/xfig/Makefile 2009/11/30 13:50:38 1.59
+++ pkgsrc/graphics/xfig/Makefile 2009/12/23 14:21:48 1.60
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.59 2009/11/30 13:50:38 itohy Exp $
+# $NetBSD: Makefile,v 1.60 2009/12/23 14:21:48 drochner Exp $
DISTNAME= xfig.3.2.5b.full
PKGNAME= xfig-3.2.5b
-PKGREVISION= 4
+PKGREVISION= 5
CATEGORIES= graphics
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=mcj/}
--- pkgsrc/graphics/xfig/distinfo 2009/11/04 15:34:08 1.21
+++ pkgsrc/graphics/xfig/distinfo 2009/12/23 14:21:48 1.22
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.21 2009/11/04 15:34:08 gdt Exp $
+$NetBSD: distinfo,v 1.22 2009/12/23 14:21:48 drochner Exp $
SHA1 (xfig.3.2.5b.full.tar.gz) = 0730d7e6bc217c0de02682efb0078821512bb542
RMD160 (xfig.3.2.5b.full.tar.gz) = aad4cfd808c116d34218e9890a898652e4f52ab6
@@ -13,3 +13,4 @@
SHA1 (patch-ak) = fcc358a595590ea3136d71bd9f61449d54914c46
SHA1 (patch-al) = ca20d3ec7bcf2ac24fd0a415495f805add23142d
SHA1 (patch-am) = 72adbda34425fda49f2072a3d40a3d942e07e1ba
+SHA1 (patch-an) = 4bfce8dbd420bc4b4d8efa5b01a39e3a9ce03ca6
$NetBSD: patch-an,v 1.1 2009/12/23 14:21:48 drochner Exp $
--- f_readold.c.orig 2007-03-29 00:23:14.000000000 +0000
+++ f_readold.c
@@ -471,7 +471,7 @@ read_1_3_textobject(FILE *fp)
F_text *t;
int n;
int dum;
- char buf[128];
+ char buf[512];
PR_SIZE tx_dim;
if ((t = create_text()) == NULL)
@@ -485,22 +485,34 @@ read_1_3_textobject(FILE *fp)
t->pen_style = -1;
t->angle = 0.0;
t->next = NULL;
+ if (!fgets(buf, sizeof(buf), fp)) {
+ file_msg("Incomplete text data");
+ free((char *) t);
+ return (NULL);
+ }
+
+ /* Note using strlen(buf) here will waste a few bytes, as the
+ various text attributes are counted into this length too. */
+ if ((t->cstring = new_string(strlen(buf))) == NULL)
+ return (NULL);
+
/* ascent and length will be recalculated later */
- n = fscanf(fp, " %d %d %d %d %d %d %d %[^\n]",
+ n = sscanf(buf, " %d %d %d %d %d %d %d %[^\n]",
&t->font, &dum, &dum, &t->ascent, &t->length,
- &t->base_x, &t->base_y, buf);
+ &t->base_x, &t->base_y, t->cstring);
if (n != 8) {
file_msg("Incomplete text data");
+ free(t->cstring);
free((char *) t);
return (NULL);
}
- if ((t->cstring = new_string(strlen(buf))) == NULL) {
+
+ if (!strlen(t->cstring)) {
+ free(t->cstring);
free((char *) t);
file_msg("Empty text string at line %d.", line_no);
return (NULL);
}
- /* put string in structure */
- strcpy(t->cstring, buf);
/* get the font struct */
t->zoom = zoomscale;