pxcloud/freerdp2
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

debian/patches: Add 0001_CVE-2019-17177.patch. Fix realloc return handling. (CVE-2019-17177).

Browse Source
This commit is contained in:
Mike Gabriel 2019-12-16 11:25:08 +01:00
parent 2cf66b3b81
commit c6fe442da0
2 changed files with 172 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

171
debian/patches/0001_CVE-2019-17177.patch vendored Normal file
View File

@ -0,0 +1,171 @@
From fc80ab45621bd966f70594c0b7393ec005a94007 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Fri, 4 Oct 2019 14:49:30 +0200
Subject: [PATCH] Fixed #5645: realloc return handling
---
client/X11/generate_argument_docbook.c | 33 +++++++++++++++++++++-----
libfreerdp/codec/region.c | 20 ++++++++++++----
winpr/libwinpr/utils/lodepng/lodepng.c | 6 ++++-
3 files changed, 48 insertions(+), 11 deletions(-)
--- a/client/X11/generate_argument_docbook.c
+++ b/client/X11/generate_argument_docbook.c
@@ -9,6 +9,7 @@
LPSTR tr_esc_str(LPCSTR arg, bool format)
{
LPSTR tmp = NULL;
+ LPSTR tmp2 = NULL;
size_t cs = 0, x, ds, len;
size_t s;
@@ -25,7 +26,12 @@
ds = s + 1;
if (s)
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ {
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
+ }
if (NULL == tmp)
{
@@ -43,7 +49,10 @@
case '<':
len = format ? 13 : 4;
ds += len - 1;
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
if (NULL == tmp)
{
@@ -64,7 +73,10 @@
case '>':
len = format ? 14 : 4;
ds += len - 1;
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
if (NULL == tmp)
{
@@ -84,7 +96,10 @@
case '\'':
ds += 5;
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
if (NULL == tmp)
{
@@ -102,7 +117,10 @@
case '"':
ds += 5;
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
if (NULL == tmp)
{
@@ -120,7 +138,10 @@
case '&':
ds += 4;
- tmp = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ tmp2 = (LPSTR)realloc(tmp, ds * sizeof(CHAR));
+ if (!tmp2)
+ free(tmp);
+ tmp = tmp2;
if (NULL == tmp)
{
--- a/libfreerdp/codec/region.c
+++ b/libfreerdp/codec/region.c
@@ -469,8 +469,12 @@
if (finalNbRects != nbRects)
{
- int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
- region->data = realloc(region->data, allocSize);
+ REGION16_DATA* data;
+ size_t allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
+ data = realloc(region->data, allocSize);
+ if (!data)
+ free(region->data);
+ region->data = data;
if (!region->data)
{
@@ -487,6 +491,7 @@
BOOL region16_union_rect(REGION16* dst, const REGION16* src, const RECTANGLE_16* rect)
{
+ REGION16_DATA* data;
const RECTANGLE_16* srcExtents;
RECTANGLE_16* dstExtents;
const RECTANGLE_16* currentBand, *endSrcRect, *nextBand;
@@ -675,7 +680,10 @@
dstExtents->bottom = MAX(rect->bottom, srcExtents->bottom);
dstExtents->right = MAX(rect->right, srcExtents->right);
newItems->size = sizeof(REGION16_DATA) + (usedRects * sizeof(RECTANGLE_16));
- dst->data = realloc(newItems, newItems->size);
+ data = realloc(newItems, newItems->size);
+ if (!data)
+ free(dst->data);
+ dst->data = data;
if (!dst->data)
{
@@ -719,6 +727,7 @@
BOOL region16_intersect_rect(REGION16* dst, const REGION16* src, const RECTANGLE_16* rect)
{
+ REGION16_DATA* data;
REGION16_DATA* newItems;
const RECTANGLE_16* srcPtr, *endPtr, *srcExtents;
RECTANGLE_16* dstPtr;
@@ -791,7 +800,10 @@
if (dst->data->size)
free(dst->data);
- dst->data = realloc(newItems, newItems->size);
+ data = realloc(newItems, newItems->size);
+ if (!data)
+ free(dst->data);
+ dst->data = data;
if (!dst->data)
{
--- a/winpr/libwinpr/utils/lodepng/lodepng.c
+++ b/winpr/libwinpr/utils/lodepng/lodepng.c
@@ -840,11 +840,15 @@
static unsigned HuffmanTree_makeFromFrequencies(HuffmanTree* tree, const unsigned* frequencies,
size_t mincodes, size_t numcodes, unsigned maxbitlen)
{
+ unsigned* lengths;
unsigned error = 0;
while(!frequencies[numcodes - 1] && numcodes > mincodes) numcodes--; /*trim zeroes*/
tree->maxbitlen = maxbitlen;
tree->numcodes = (unsigned)numcodes; /*number of symbols*/
- tree->lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));
+ lengths = (unsigned*)realloc(tree->lengths, numcodes * sizeof(unsigned));
+ if (!lengths)
+ free(tree->lengths);
+ tree->lengths = lengths;
if(!tree->lengths) return 83; /*alloc fail*/
/*initialize all lengths to 0*/
memset(tree->lengths, 0, numcodes * sizeof(unsigned));

1
debian/patches/series vendored
View File

@ -1 +1,2 @@
1001_spelling-fixes.patch
0001_CVE-2019-17177.patch