From 4636007dd4cebca8ee10738a7833f629d8687529 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sat, 17 Dec 2022 12:23:45 -0800 Subject: Fix CVE-2022-46285: Infinite loop on unclosed comments When reading XPM images from a file with libXpm 3.5.14 or older, if a comment in the file is not closed (i.e. a C-style comment starts with "/*" and is missing the closing "*/"), the ParseComment() function will loop forever calling getc() to try to read the rest of the comment, failing to notice that it has returned EOF, which may cause a denial of service to the calling program. Reported-by: Marco Ivaldi Signed-off-by: Alan Coopersmith Origin: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d765014816c566c63165c63ca8 --- lib/Xm/Xpmdata.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/Xm/Xpmdata.c b/lib/Xm/Xpmdata.c index d65ae57..9c53f90 100644 --- a/lib/Xm/Xpmdata.c +++ b/lib/Xm/Xpmdata.c @@ -171,6 +171,10 @@ ParseComment(mdata) notend = 0; ungetc(*s, file); } + else if (c == EOF) { + /* hit end of file before the end of the comment */ + return XpmFileInvalid; + } } return 0; } -- 2.46.0