diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2015-07-31 15:07:22 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2015-07-31 15:08:00 +0000 |
| commit | 65e4c60a4f8332d1525882aa8b02db6d3c554ffe (patch) | |
| tree | 8c3084cf5fea3f330ba29201cf2648f80ef1bf33 /main/ghostscript/CVE-2015-3228.patch | |
| parent | f9376f05439ebebe90c0fb5ef0bf2e8a45c86259 (diff) | |
| download | aports-65e4c60a4f8332d1525882aa8b02db6d3c554ffe.tar.bz2 aports-65e4c60a4f8332d1525882aa8b02db6d3c554ffe.tar.xz | |
main/ghostscript: security fix for CVE-2015-3228
ref #4468
Diffstat (limited to 'main/ghostscript/CVE-2015-3228.patch')
| -rw-r--r-- | main/ghostscript/CVE-2015-3228.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/main/ghostscript/CVE-2015-3228.patch b/main/ghostscript/CVE-2015-3228.patch new file mode 100644 index 0000000000..ebd87f7bf7 --- /dev/null +++ b/main/ghostscript/CVE-2015-3228.patch @@ -0,0 +1,29 @@ +From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Tue, 7 Jul 2015 16:57:41 +0100 +Subject: [PATCH] Bug 696041: sanity check for memory allocation. + +In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the +variable holding the actual number of bytes we allocate. + +No cluster differences +--- + gs/base/gsmalloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gs/base/gsmalloc.c b/gs/base/gsmalloc.c +index 624552d..cad79c2 100644 +--- a/base/gsmalloc.c ++++ b/base/gsmalloc.c +@@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size, client_name_t cname) + } else { + uint added = size + sizeof(gs_malloc_block_t); + +- if (mmem->limit - added < mmem->used) ++ if (added <= size || mmem->limit - added < mmem->used) + set_msg("exceeded limit"); + else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0) + set_msg("failed"); +-- +2.4.6 + |