01/04: gnu: optipng: Fix CVE-2017-1000229.

[Marius Bakke]

mbakke pushed a commit to branch master
in repository guix.

commit 0e7fb0cd9b91e873b5f9d04c49472b06aff6911f
Author: Marius Bakke <address@hidden>
Date:   Tue Nov 28 17:41:33 2017 +0100

    gnu: optipng: Fix CVE-2017-1000229.
    
    * gnu/packages/image.scm (optipng)[source](patches): New field.
    * gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Register it.
---
 gnu/local.mk                                       |  1 +
 gnu/packages/image.scm                             |  1 +
 .../patches/optipng-CVE-2017-1000229.patch         | 22 ++++++++++++++++++++++
 3 files changed, 24 insertions(+)

diff --git a/gnu/local.mk b/gnu/local.mk
index 5ea975c..19db3c4 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -940,6 +940,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/openssl-runpath.patch                   \
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch         \
   %D%/packages/patches/openssl-c-rehash-in.patch               \
+  %D%/packages/patches/optipng-CVE-2017-1000229.patch          \
   %D%/packages/patches/orpheus-cast-errors-and-includes.patch  \
   %D%/packages/patches/osip-CVE-2017-7853.patch                        \
   %D%/packages/patches/ots-no-include-missing-file.patch       \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 0e1f025..b9f1ef2 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1095,6 +1095,7 @@ installed as @code{stb_image}.")
        (method url-fetch)
        (uri (string-append 
"http://prdownloads.sourceforge.net/optipng/optipng-";
                            version ".tar.gz"))
+       (patches (search-patches "optipng-CVE-2017-1000229.patch"))
        (sha256
         (base32
          "105yk5qykvhiahzag67gm36s2kplxf6qn5hay02md0nkrcgn6w28"))))
diff --git a/gnu/packages/patches/optipng-CVE-2017-1000229.patch 
b/gnu/packages/patches/optipng-CVE-2017-1000229.patch
new file mode 100644
index 0000000..2cb3b2f
--- /dev/null
+++ b/gnu/packages/patches/optipng-CVE-2017-1000229.patch
@@ -0,0 +1,22 @@
+Fix CVE-2017-1000229:
+
+https://security-tracker.debian.org/tracker/CVE-2017-1000229
+https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html
+https://nvd.nist.gov/vuln/detail/CVE-2017-1000229
+
+Patch copied from upstream bug tracker:
+https://sourceforge.net/p/optipng/bugs/65/
+
+diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
+index b4910ec..5f9b376 100644
+--- a/src/minitiff/tiffread.c
++++ b/src/minitiff/tiffread.c
+@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE 
*fp)
+         count = tiff_ptr->strip_offsets_count;
+         if (count == 0 || count > tiff_ptr->height)
+             goto err_invalid;
++        if (count > (size_t)-1 / sizeof(long))
++            goto err_memory;
+         tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
+         if (tiff_ptr->strip_offsets == NULL)
+             goto err_memory;