* [Buildroot] [PATCH 1/1] package/exim: add upstream security fix
@ 2019-09-28 9:01 Bernd Kuhls
2019-09-28 20:13 ` Thomas Petazzoni
2019-10-01 6:26 ` Peter Korsgaard
0 siblings, 2 replies; 3+ messages in thread
From: Bernd Kuhls @ 2019-09-28 9:01 UTC (permalink / raw)
To: buildroot
Fixes CVE-2019-16928:
https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
...ix-buffer-overflow-in-string_vformat.patch | 44 +++++++++++++++++++
1 file changed, 44 insertions(+)
create mode 100644 package/exim/0006-Fix-buffer-overflow-in-string_vformat.patch
diff --git a/package/exim/0006-Fix-buffer-overflow-in-string_vformat.patch b/package/exim/0006-Fix-buffer-overflow-in-string_vformat.patch
new file mode 100644
index 0000000000..2874a2bcc1
--- /dev/null
+++ b/package/exim/0006-Fix-buffer-overflow-in-string_vformat.patch
@@ -0,0 +1,44 @@
+From 478effbfd9c3cc5a627fc671d4bf94d13670d65f Mon Sep 17 00:00:00 2001
+From: Jeremy Harris <jgh146exb@wizmail.org>
+Date: Fri, 27 Sep 2019 12:21:49 +0100
+Subject: [PATCH] Fix buffer overflow in string_vformat. Bug 2449
+
+Fixes CVE-2019-16928:
+https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html
+
+Downloaded from upstream commit
+https://git.exim.org/exim.git/patch/478effbfd9c3cc5a627fc671d4bf94d13670d65f
+
+[adjusted patch of string.c and removed patches for test/]
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+---
+ src/string.c | 4 ++--
+ scripts/0000-Basic/0214 | 11 +++++++++++
+ stdout/0214 | 7 +++++++
+ 3 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/src/src/string.c b/src/src/string.c
+index c6549bf..3445f8a 100644
+--- a/src/string.c
++++ b/src/string.c
+@@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1));
+ Arguments:
+ g the growable-string
+ p current end of data
+- count amount to grow by
++ count amount to grow by, offset from p
+ */
+
+ static void
+@@ -1590,7 +1590,7 @@ while (*fp)
+ }
+ else if (g->ptr >= lim - width)
+ {
+- gstring_grow(g, g->ptr, width - (lim - g->ptr));
++ gstring_grow(g, g->ptr, width);
+ lim = g->size - 1;
+ gp = CS g->s + g->ptr;
+ }
+--
+1.9.1
+
--
2.20.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/exim: add upstream security fix
2019-09-28 9:01 [Buildroot] [PATCH 1/1] package/exim: add upstream security fix Bernd Kuhls
@ 2019-09-28 20:13 ` Thomas Petazzoni
2019-10-01 6:26 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Petazzoni @ 2019-09-28 20:13 UTC (permalink / raw)
To: buildroot
On Sat, 28 Sep 2019 11:01:33 +0200
Bernd Kuhls <bernd.kuhls@t-online.de> wrote:
> Fixes CVE-2019-16928:
> https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html
>
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
> ---
> ...ix-buffer-overflow-in-string_vformat.patch | 44 +++++++++++++++++++
> 1 file changed, 44 insertions(+)
> create mode 100644 package/exim/0006-Fix-buffer-overflow-in-string_vformat.patch
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/exim: add upstream security fix
2019-09-28 9:01 [Buildroot] [PATCH 1/1] package/exim: add upstream security fix Bernd Kuhls
2019-09-28 20:13 ` Thomas Petazzoni
@ 2019-10-01 6:26 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2019-10-01 6:26 UTC (permalink / raw)
To: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Fixes CVE-2019-16928:
> https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Committed to 2019.02.x, 2019.05.x and 2019.08.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-10-01 6:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-28 9:01 [Buildroot] [PATCH 1/1] package/exim: add upstream security fix Bernd Kuhls
2019-09-28 20:13 ` Thomas Petazzoni
2019-10-01 6:26 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.