mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-27 07:57:27 +00:00
Gyorgy Sarvari
922de306a6
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-15279 Pick the patch that mentions this vulnerability ID explicitly. Also, this patch has caused some regression - pick the patch also that fixed that regression. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
36 lines
1.2 KiB
Diff
36 lines
1.2 KiB
Diff
From 4cd078071e2487f052ec997ee13bb910d796587b Mon Sep 17 00:00:00 2001
|
|
From: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
Date: Mon, 12 Jan 2026 22:45:16 +0100
|
|
Subject: [PATCH] Fix CVE-2025-15279: Move bounds check inside cnt >= 3 block
|
|
(#5723)
|
|
|
|
From: Ahmet Furkan Kavraz <55850855+ahmetfurkankavraz@users.noreply.github.com>
|
|
|
|
Co-authored-by: Ahmet Furkan Kavraz <kavraz@amazon.com>
|
|
|
|
CVE: CVE-2025-15279
|
|
Upstream-Status: Backport [https://github.com/fontforge/fontforge/commit/720ea95020c964202928afd2e93b0f5fac11027e]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
gutils/gimagereadbmp.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/gutils/gimagereadbmp.c b/gutils/gimagereadbmp.c
|
|
index 133336787..ad365158c 100644
|
|
--- a/gutils/gimagereadbmp.c
|
|
+++ b/gutils/gimagereadbmp.c
|
|
@@ -190,10 +190,10 @@ static int readpixels(FILE *file,struct bmpheader *head) {
|
|
head->byte_pixels[ii++] = ch;
|
|
} else {
|
|
cnt = getc(file);
|
|
- if (cnt < 0 || ii + cnt > head->height * head->width) {
|
|
- return 0;
|
|
- }
|
|
if ( cnt>= 3 ) {
|
|
+ if (ii + cnt > head->height * head->width) {
|
|
+ return 0;
|
|
+ }
|
|
int odd = cnt&1;
|
|
while ( --cnt>=0 )
|
|
head->byte_pixels[ii++] = getc(file);
|