File 026-CVE-2021-34552.patch of Package python-Pillow

Overview Repositories Revisions Requests Users Attributes Meta

File 026-CVE-2021-34552.patch of Package python-Pillow

From 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Tue, 15 Jun 2021 15:14:26 +1000
Subject: [PATCH 1/2] Limit sprintf modes to 10 characters

---
 src/libImaging/Convert.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
index 8c7be36a27..1fa74a13b3 100644
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1337,9 +1337,8 @@ convert(
         return (Imaging) ImagingError_ValueError("conversion not supported");
 #else
     {
-      static char buf[256];
-      /* FIXME: may overflow if mode is too large */
-      sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
+      static char buf[100];
+      sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
       return (Imaging) ImagingError_ValueError(buf);
     }
 #endif
@@ -1393,9 +1392,8 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
     }
 #else
     {
-      static char buf[256];
-      /* FIXME: may overflow if mode is too large */
+      static char buf[100];
-      sprintf(buf, "conversion from %s to %s not supported in convert_transparent", imIn->mode, mode);
+      sprintf(buf, "conversion from %.10s to %.10s not supported in convert_transparent", imIn->mode, mode);
       return (Imaging) ImagingError_ValueError(buf);
     }
 #endif
From 518ee3722a99d7f7d890db82a20bd81c1c0327fb Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Wed, 30 Jun 2021 23:47:10 +1000
Subject: [PATCH 2/2] Use snprintf instead of sprintf

---
 src/libImaging/Convert.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
index 1fa74a13b3..9012cfcd74 100644
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1338,7 +1338,7 @@ convert(
 #else
     {
       static char buf[100];
-      sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
+      snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
       return (Imaging) ImagingError_ValueError(buf);
     }
 #endif
@@ -1393,7 +1393,7 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
 #else
     {
       static char buf[100];
-      sprintf(buf, "conversion from %.10s to %.10s not supported in convert_transparent", imIn->mode, mode);
+      snprintf(buf, 100, "conversion from %.10s to %.10s not supported in convert_transparent", imIn->mode, mode);
       return (Imaging) ImagingError_ValueError(buf);
     }
 #endif

Places

File 026-CVE-2021-34552.patch of Package python-Pillow

Places