mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-01 06:32:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

ghostscript: fix CVE-2023-46361

Browse Source 
Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability
via jbig2_error at /jbig2dec/jbig2.c.

(From OE-Core rev: 3e9018fb14466495be7472a8620918347c732e86)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Archana Polampalli
2024-11-08 13:09:12 +00:00
committed by Steve Sakoman
parent 3aaed26728
commit a84e68cd5d
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
meta/recipes-extended/ghostscript/ghostscript/CVE-2023-46361.patch Normal file
View File

@@ -0,0 +1,32 @@
From 44ca5b9d023e1de33fcb8984c85bb29619c4db7e Mon Sep 17 00:00:00 2001
From: Sebastian Rasmussen <sebras@gmail.com>
Date: Sun, 5 Nov 2023 12:21:52 +0100
Subject: [PATCH] Bug 705041: jbig2dec: Avoid uninitialized allocator in
command-line tool.
This fixes CVE-2023-46361.
CVE: CVE-2023-46361
Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=44ca5b9d023e1de33fcb8984c85bb29619c4db7e]
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
jbig2dec/jbig2dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/jbig2dec/jbig2dec.c b/jbig2dec/jbig2dec.c
index dc1fd56..78c8e89 100644
--- a/jbig2dec/jbig2dec.c
+++ b/jbig2dec/jbig2dec.c
@@ -567,7 +567,7 @@ main(int argc, char **argv)
{
jbig2dec_params_t params;
jbig2dec_error_callback_state_t error_callback_state;
- jbig2dec_allocator_t allocator_;
+ jbig2dec_allocator_t allocator_ = { 0 };
jbig2dec_allocator_t *allocator = &allocator_;
Jbig2Ctx *ctx = NULL;
FILE *f = NULL, *f_page = NULL;
--
2.40.0