From: Thomas Deutschmann <whissi@gentoo.org>
Date: Sun, 27 Oct 2019 00:41:03 +0000 (+0200)
Subject: sys-apps/file: fix CVE-2019-18218
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=e4782ac407f7b8744abf6bb7fe9e60bdd2dffa64;p=gentoo.git

sys-apps/file: fix CVE-2019-18218

Bug: https://bugs.gentoo.org/698610
Package-Manager: Portage-2.3.78, Repoman-2.3.17
Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>
---

diff --git a/sys-apps/file/file-5.37.ebuild b/sys-apps/file/file-5.37-r1.ebuild
similarity index 98%
rename from sys-apps/file/file-5.37.ebuild
rename to sys-apps/file/file-5.37-r1.ebuild
index 7aa0f8d8888c..5b6cf1db5d03 100644
--- a/sys-apps/file/file-5.37.ebuild
+++ b/sys-apps/file/file-5.37-r1.ebuild
@@ -33,6 +33,8 @@ DEPEND="
 RDEPEND="${DEPEND}
 	python? ( !dev-python/python-magic )"
 
+PATCHES=( "${FILESDIR}"/${P}-CVE-2019-18218.patch )
+
 src_prepare() {
 	default
 
diff --git a/sys-apps/file/files/file-5.37-CVE-2019-18218.patch b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch
new file mode 100644
index 000000000000..1cd02b778abf
--- /dev/null
+++ b/sys-apps/file/files/file-5.37-CVE-2019-18218.patch
@@ -0,0 +1,36 @@
+CVE-2019-18218
+https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
+
+--- a/src/cdf.c
++++ b/src/cdf.c
+@@ -1027,8 +1027,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+ 				goto out;
+ 			}
+ 			nelements = CDF_GETUINT32(q, 1);
+-			if (nelements == 0) {
+-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
++			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
++				DPRINTF(("CDF_VECTOR with nelements == %"
++				    SIZE_T_FORMAT "u\n", nelements));
+ 				goto out;
+ 			}
+ 			slen = 2;
+@@ -1070,8 +1071,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
+ 					goto out;
+ 				inp += nelem;
+ 			}
+-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+-			    nelements));
+ 			for (j = 0; j < nelements && i < sh.sh_properties;
+ 			    j++, i++)
+ 			{
+--- a/src/cdf.h
++++ b/src/cdf.h
+@@ -48,6 +48,7 @@
+ typedef int32_t cdf_secid_t;
+ 
+ #define CDF_LOOP_LIMIT					10000
++#define CDF_ELEMENT_LIMIT				100000
+ 
+ #define CDF_SECID_NULL					0
+ #define CDF_SECID_FREE					-1