40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
|
From 4636007dd4cebca8ee10738a7833f629d8687529 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||
|
|
Date: Sat, 17 Dec 2022 12:23:45 -0800
|
||
|
|
Subject: Fix CVE-2022-46285: Infinite loop on unclosed comments
|
||
|
|
|
||
|
|
When reading XPM images from a file with libXpm 3.5.14 or older, if a
|
||
|
|
comment in the file is not closed (i.e. a C-style comment starts with
|
||
|
|
"/*" and is missing the closing "*/"), the ParseComment() function will
|
||
|
|
loop forever calling getc() to try to read the rest of the comment,
|
||
|
|
failing to notice that it has returned EOF, which may cause a denial of
|
||
|
|
service to the calling program.
|
||
|
|
|
||
|
|
Reported-by: Marco Ivaldi <raptor@0xdeadbeef.info>
|
||
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||
|
|
|
||
|
|
Origin:
|
||
|
|
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d765014816c566c63165c63ca8
|
||
|
|
---
|
||
|
|
lib/Xm/Xpmdata.c | 4 ++++
|
||
|
|
1 file changed, 4 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c
|
||
|
|
index d65ae57..9c53f90 100644
|
||
|
|
--- a/lib/Xm/Xpmdata.c
|
||
|
|
+++ b/lib/Xm/Xpmdata.c
|
||
|
|
@@ -171,6 +171,10 @@ ParseComment(mdata)
|
||
|
|
notend = 0;
|
||
|
|
ungetc(*s, file);
|
||
|
|
}
|
||
|
|
+ else if (c == EOF) {
|
||
|
|
+ /* hit end of file before the end of the comment */
|
||
|
|
+ return XpmFileInvalid;
|
||
|
|
+ }
|
||
|
|
}
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.46.0
|
||
|
|
|