rpms/glib2/F-9 glib2-CVE-2008-4316.patch, NONE, 1.1 glib2.spec, 1.173, 1.174
Matthias Clasen
mclasen at fedoraproject.org
Thu Mar 12 14:08:38 UTC 2009
Author: mclasen
Update of /cvs/pkgs/rpms/glib2/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26195
Modified Files:
glib2.spec
Added Files:
glib2-CVE-2008-4316.patch
Log Message:
Fix integer overflows in the base64 handling functions.
glib2-CVE-2008-4316.patch:
--- NEW FILE glib2-CVE-2008-4316.patch ---
--- glib/gbase64.c.orig 2008-12-04 12:07:21.000000000 +0100
+++ glib/gbase64.c 2009-01-12 14:08:31.000000000 +0100
@@ -54,8 +54,9 @@ static const char base64_alphabet[] =
*
* The output buffer must be large enough to fit all the data that will
* be written to it. Due to the way base64 encodes you will need
- * at least: @len * 4 / 3 + 6 bytes. If you enable line-breaking you will
- * need at least: @len * 4 / 3 + @len * 4 / (3 * 72) + 7 bytes.
+ * at least: (@len / 3 + 1) * 4 + 4 bytes (+ 4 may be needed in case of
+ * non-zero state). If you enable line-breaking you will need at least:
+ * ((@len / 3 + 1) * 4 + 4) / 72 + 1 bytes of extra space.
*
* @break_lines is typically used when putting base64-encoded data in emails.
* It breaks the lines at 72 columns instead of putting all of the text on
@@ -233,8 +234,14 @@ g_base64_encode (const guchar *data,
g_return_val_if_fail (data != NULL, NULL);
g_return_val_if_fail (len > 0, NULL);
- /* We can use a smaller limit here, since we know the saved state is 0 */
- out = g_malloc (len * 4 / 3 + 4);
+ /* We can use a smaller limit here, since we know the saved state is 0,
+ +1 is needed for trailing \0, also check for unlikely integer overflow */
+ if (len >= ((G_MAXSIZE - 1) / 4 - 1) * 3)
+ g_error("%s: input too large for Base64 encoding (%"G_GSIZE_FORMAT" chars)",
+ G_STRLOC, len);
+
+ out = g_malloc ((len / 3 + 1) * 4 + 1);
+
outlen = g_base64_encode_step (data, len, FALSE, out, &state, &save);
outlen += g_base64_encode_close (FALSE, out + outlen, &state, &save);
out[outlen] = '\0';
@@ -275,7 +282,8 @@ static const unsigned char mime_base64_r
*
* The output buffer must be large enough to fit all the data that will
* be written to it. Since base64 encodes 3 bytes in 4 chars you need
- * at least: @len * 3 / 4 bytes.
+ * at least: (@len / 4) * 3 + 3 bytes (+ 3 may be needed in case of non-zero
+ * state).
*
* Return value: The number of bytes of output that was written
*
@@ -358,7 +366,8 @@ g_base64_decode (const gchar *text,
gsize *out_len)
{
guchar *ret;
- gint input_length, state = 0;
+ gsize input_length;
+ gint state = 0;
guint save = 0;
g_return_val_if_fail (text != NULL, NULL);
@@ -368,7 +377,9 @@ g_base64_decode (const gchar *text,
g_return_val_if_fail (input_length > 1, NULL);
- ret = g_malloc0 (input_length * 3 / 4);
+ /* We can use a smaller limit here, since we know the saved state is 0,
+ +1 used to avoid calling g_malloc0(0), and hence retruning NULL */
+ ret = g_malloc0 ((input_length / 4) * 3 + 1);
*out_len = g_base64_decode_step (text, input_length, ret, &state, &save);
Index: glib2.spec
===================================================================
RCS file: /cvs/pkgs/rpms/glib2/F-9/glib2.spec,v
retrieving revision 1.173
retrieving revision 1.174
diff -u -r1.173 -r1.174
--- glib2.spec 27 Oct 2008 22:27:48 -0000 1.173
+++ glib2.spec 12 Mar 2009 14:08:07 -0000 1.174
@@ -3,7 +3,7 @@
Summary: A library of handy utility functions
Name: glib2
Version: 2.16.6
-Release: 2%{?dist}
+Release: 3%{?dist}
License: LGPLv2+
Group: System Environment/Libraries
URL: http://www.gtk.org
@@ -24,6 +24,8 @@
Patch3: glib-i386-atomic.patch
+Patch4: glib2-CVE-2008-4316.patch
+
%description
GLib is the low-level core library that forms the basis
for projects such as GTK+ and GNOME. It provides data structure
@@ -57,6 +59,7 @@
%setup -q -n glib-%{version}
%patch2 -p0 -b .only-pass-uri-to-gio-apps
%patch3 -p1 -b .i386-atomic
+%patch4 -p0 -b .CVE-2008-4316
%build
%configure --disable-gtk-doc --enable-static
@@ -131,6 +134,9 @@
%{_libdir}/lib*.a
%changelog
+* Thu Mar 12 2009 Matthias Clasen <mclasen at redhat.com> - 2.16.6-3
+- Fix integer overflows in the base64 handling functions. CVE-2008-4316
+
* Mon Oct 27 2008 Matthias Clasen <mclasen at redhat.com> - 2.16.6-2
- Use asm implementation for atomic ops on x86
More information about the fedora-extras-commits
mailing list