3 files changed, 94 insertions, 0 deletions

diff --git a/meta-python/recipes-devtools/python/python3-pillow/0001-Limit-sprintf-modes-to-10-characters.patch b/meta-python/recipes-devtools/python/python3-pillow/0001-Limit-sprintf-modes-to-10-characters.patch
new file mode 100644
index 0000000000..a1dd0d29ff
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/0001-Limit-sprintf-modes-to-10-characters.patch
@@ -0,0 +1,49 @@
+From 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Tue, 15 Jun 2021 15:14:26 +1000
+Subject: [PATCH 1/1] Limit sprintf modes to 10 characters
+
+Needed to make CVE-2021-34552 fix apply cleanly.
+
+commit 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 (unmodified)
+
+Upstream-Status: Backport
+Signed-off-by: Joe Slater <joe.slater@windriver.com>
+
+---
+ src/libImaging/Convert.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
+index 8c7be36a2..1fa74a13b 100644
+--- a/src/libImaging/Convert.c
++++ b/src/libImaging/Convert.c
+@@ -1594,9 +1594,8 @@ convert(
+ #ifdef notdef
+         return (Imaging)ImagingError_ValueError("conversion not supported");
+ #else
+-        static char buf[256];
+-        /* FIXME: may overflow if mode is too large */
+-        sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
++        static char buf[100];
++        sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
+         return (Imaging)ImagingError_ValueError(buf);
+ #endif
+     }
+@@ -1645,11 +1644,10 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
+     }
+ #else
+     {
+-        static char buf[256];
+-        /* FIXME: may overflow if mode is too large */
++        static char buf[100];
+         sprintf(
+             buf,
+-            "conversion from %s to %s not supported in convert_transparent",
++            "conversion from %.10s to %.10s not supported in convert_transparent",
+             imIn->mode,
+             mode);
+         return (Imaging)ImagingError_ValueError(buf);
+-- 
+2.29.2
+
diff --git a/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch b/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch
new file mode 100644
index 0000000000..fc0337f137
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch
@@ -0,0 +1,43 @@
+From 518ee3722a99d7f7d890db82a20bd81c1c0327fb Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Wed, 30 Jun 2021 23:47:10 +1000
+Subject: [PATCH 1/1] Use snprintf instead of sprintf
+
+Fix CVE-2021-34552.
+
+commit 518ee3722a99d7f7d890db82a20bd81c1c0327fb (unmodified)
+
+Upstream-Status: Backport
+Signed-off-by: Joe Slater <joe.slater@windriver.com>
+
+---
+ src/libImaging/Convert.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
+index 1fa74a13b..9012cfcd7 100644
+--- a/src/libImaging/Convert.c
++++ b/src/libImaging/Convert.c
+@@ -1595,7 +1595,7 @@ convert(
+         return (Imaging)ImagingError_ValueError("conversion not supported");
+ #else
+         static char buf[100];
+-        sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
++        snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
+         return (Imaging)ImagingError_ValueError(buf);
+ #endif
+     }
+@@ -1645,8 +1645,9 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
+ #else
+     {
+         static char buf[100];
+-        sprintf(
++        snprintf(
+             buf,
++            100,
+             "conversion from %.10s to %.10s not supported in convert_transparent",
+             imIn->mode,
+             mode);
+-- 
+2.29.2
+
diff --git a/meta-python/recipes-devtools/python/python3-pillow_8.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_8.2.0.bb
index 3241230d13..40745bb763 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_8.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_8.2.0.bb
@@ -8,6 +8,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=0337b116233da4616ae9fdb130bf6f1a"
 SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=8.2.x \
            file://0001-support-cross-compiling.patch \
            file://0001-explicitly-set-compile-options.patch \
+           file://0001-Limit-sprintf-modes-to-10-characters.patch \
+           file://0001-Use-snprintf-instead-of-sprintf.patch \
 "
 SRCREV ?= "e0e353c0ef7516979a9aedce3792596649ce4433"