summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--recipes-core/zlib/files/CVE-2022-37434.patch37
1 files changed, 0 insertions, 37 deletions
diff --git a/recipes-core/zlib/files/CVE-2022-37434.patch b/recipes-core/zlib/files/CVE-2022-37434.patch
deleted file mode 100644
index 052cdf60..00000000
--- a/recipes-core/zlib/files/CVE-2022-37434.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
2From: Mark Adler <fork@madler.net>
3Date: Sat, 30 Jul 2022 15:51:11 -0700
4Subject: [PATCH] Fix a bug when getting a gzip header extra field with
5 inflate().
6
7If the extra field was larger than the space the user provided with
8inflateGetHeader(), and if multiple calls of inflate() delivered
9the extra header data, then there could be a buffer overflow of the
10provided space. This commit assures that provided space is not
11exceeded.
12
13Upstream-Status: Backport
14[ https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 ]
15CVE: CVE-2022-37434
16Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
17---
18 inflate.c | 5 +++--
19 1 file changed, 3 insertions(+), 2 deletions(-)
20
21diff --git a/inflate.c b/inflate.c
22index 7be8c6366..7a7289749 100644
23--- a/inflate.c
24+++ b/inflate.c
25@@ -763,9 +763,10 @@ int flush;
26 copy = state->length;
27 if (copy > have) copy = have;
28 if (copy) {
29+ len = state->head->extra_len - state->length;
30 if (state->head != Z_NULL &&
31- state->head->extra != Z_NULL) {
32- len = state->head->extra_len - state->length;
33+ state->head->extra != Z_NULL &&
34+ len < state->head->extra_max) {
35 zmemcpy(state->head->extra + len, next,
36 len + copy > state->head->extra_max ?
37 state->head->extra_max - len : copy);