sys-apps/file: fix CVE-2019-18218

Bug: https://bugs.gentoo.org/698610
Package-Manager: Portage-2.3.78, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

diff --git a/sys-apps/file/file-5.37.ebuild b/sys-apps/file/file-5.37-r1.ebuild
similarity index 98%
rename from sys-apps/file/file-5.37.ebuild
rename to sys-apps/file/file-5.37-r1.ebuild
index 7aa0f8d8888cc892251a77b41c0e54a760fc33de..5b6cf1db5d0394f7cf0db5f7af23f2068a6acf6b 100644 (file)
--- a/sys-apps/file/file-5.37.ebuild
+++ b/sys-apps/file/file-5.37-r1.ebuild
@@ -33,6 +33,8 @@ DEPEND="
 RDEPEND="${DEPEND}
        python? ( !dev-python/python-magic )"
 
+PATCHES=( "${FILESDIR}"/${P}-CVE-2019-18218.patch )
+
 src_prepare() {
        default
 

diff --git a/sys-apps/file/files/file-5.37-CVE-2019-18218.patch b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch
new file mode 100644 (file)
index 0000000..1cd02b7
--- /dev/null
+++ b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch
@@ -0,0 +1,36 @@
+CVE-2019-18218
+https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
+
+--- a/src/cdf.c
++++ b/src/cdf.c
+@@ -1027,8 +1027,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+                               goto out;
+                       }
+                       nelements = CDF_GETUINT32(q, 1);
+-                      if (nelements == 0) {
+-                              DPRINTF(("CDF_VECTOR with nelements == 0\n"));
++                      if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
++                              DPRINTF(("CDF_VECTOR with nelements == %"
++                                  SIZE_T_FORMAT "u\n", nelements));
+                               goto out;
+                       }
+                       slen = 2;
+@@ -1070,8 +1071,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+                                       goto out;
+                               inp += nelem;
+                       }
+-                      DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+-                          nelements));
+                       for (j = 0; j < nelements && i < sh.sh_properties;
+                           j++, i++)
+                       {
+--- a/src/cdf.h
++++ b/src/cdf.h
+@@ -48,6 +48,7 @@
+ typedef int32_t cdf_secid_t;
+ 
+ #define CDF_LOOP_LIMIT                                        10000
++#define CDF_ELEMENT_LIMIT                             100000
+ 
+ #define CDF_SECID_NULL                                        0
+ #define CDF_SECID_FREE                                        -1