commit wv

Hello community, here is the log from the commit of package wv checked in at Wed Nov 15 18:21:31 CET 2006. -------- --- wv/wv.changes 2006-10-21 23:24:00.000000000 +0200 +++ /mounts/work_src_done/STABLE/wv/wv.changes 2006-11-15 12:05:07.000000000 +0100 @@ -1,0 +2,5 @@ +Wed Nov 15 12:05:04 CET 2006 - prusnak@suse.cz + +- fixed VUL-0: overflow (overflow.patch) [#215612] + +------------------------------------------------------------------- New: ---- wv-1.0.3-overflow.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wv.spec ++++++ --- /var/tmp/diff_new_pack.IQcPWG/_old 2006-11-15 18:19:54.000000000 +0100 +++ /var/tmp/diff_new_pack.IQcPWG/_new 2006-11-15 18:19:54.000000000 +0100 @@ -14,11 +14,11 @@ BuildRequires: freetype2-devel libtiff-devel libwmf-devel libxml2-devel pkgconfig w3m Obsoletes: mswordvw Provides: mswordvw -License: GNU General Public License (GPL) - all versions, GNU Library General Public License v. 2.0 and 2.1 (LGPL) +License: GNU General Public License (GPL), GNU Library General Public License v. 2.0 and 2.1 (LGPL) Group: Productivity/Publishing/Word Autoreqprov: on Version: 1.0.3 -Release: 32 +Release: 40 Summary: Word 8 Converter for Unix URL: http://wvWare.sourceforge.net/ Source: http://www.csn.ul.ie/~caolan/publink/mswordview/wv-%{version}.tar.bz2 @@ -27,6 +27,7 @@ Patch5: wv-%{version}-wvText.patch Patch6: wv-libole2-readonly.patch Patch7: wv-%{version}-pc.patch +Patch8: wv-%{version}-overflow.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -65,6 +66,7 @@ %patch5 %patch6 %patch7 +%patch8 %build autoreconf -f -i --verbose @@ -120,6 +122,8 @@ %{_libdir}/*.so %changelog -n wv +* Wed Nov 15 2006 - prusnak@suse.cz +- fixed VUL-0: overflow (overflow.patch) [#215612] * Sat Oct 21 2006 - dmueller@suse.de - build against system expat to reduce code size * Thu Jan 26 2006 - nadvornik@suse.cz ++++++ wv-1.0.3-overflow.patch ++++++ --- lfo.c +++ lfo.c @@ -1,5 +1,6 @@ #include #include +#include #ifdef HAVE_CONFIG_H #include "config.h" #endif @@ -12,6 +13,16 @@ followed by its corresponding LVL structure (if LFOLVL.fFormatting is set). */ +static int +multiplication_will_overflow(U32 a, U32 b) +{ + if((a > 0) && (b > 0) && (UINT_MAX / a) >= b) { + return 0; + } + + return 1; +} + int wvGetLFO_records (LFO ** lfo, LFOLVL ** lfolvl, LVL ** lvl, U32 * nolfo, U32 * nooflvl, U32 offset, U32 len, wvStream * fd) @@ -29,7 +40,9 @@ wvTrace (("pos %x %d\n", wvStream_tell (fd), *nooflvl)); wvTrace (("nolfo is %d nooflvl is %d\n", *nolfo, *nooflvl)); - if (*nooflvl == 0) + if ((*nooflvl == 0) || + multiplication_will_overflow(sizeof (LFOLVL), *nooflvl) || + multiplication_will_overflow(sizeof (LVL), *nooflvl)) { *lfolvl = NULL; *lvl = NULL; @@ -81,16 +94,22 @@ *nolfo = read_32ubit (fd); wvTrace (("%d\n", *nolfo)); - *lfo = (LFO *) wvMalloc (*nolfo * sizeof (LFO)); - if (*lfo == NULL) - { - wvError ( - ("NO MEM 1, failed to alloc %d bytes\n", + /* check for integer overflow */ + if (multiplication_will_overflow(*nolfo, sizeof(LFO))) { + wvError (("Malicious document!\n")); + *nolfo = 0; + return (1); + } else { + *lfo = (LFO *) wvMalloc (*nolfo * sizeof(LFO)); + if (*lfo == NULL) + { + wvError (("NO MEM 1, failed to alloc %d bytes\n", *nolfo * sizeof (LFO))); return (1); - } - for (i = 0; i < *nolfo; i++) + } + for (i = 0; i < *nolfo; i++) wvGetLFO (&((*lfo)[i]), fd); + } } return (0); } ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org