From patchwork Sun Jul 21 14:25:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Armin Kuster X-Patchwork-Id: 169318 Delivered-To: patch@linaro.org Received: by 2002:a92:4782:0:0:0:0:0 with SMTP id e2csp6410828ilk; Sun, 21 Jul 2019 07:27:53 -0700 (PDT) X-Google-Smtp-Source: APXvYqwjk+Uhpv1iTp92WTS0CIOFXqQW94VXrB4XroGS8kak/4uRcSl34+hmEngP4t5ULfzNBoJk X-Received: by 2002:a63:5f95:: with SMTP id t143mr6834698pgb.304.1563719273054; Sun, 21 Jul 2019 07:27:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563719273; cv=none; d=google.com; s=arc-20160816; b=PAyUPucHOGio/zCSR51qEnGLyktY9jFR8yLkwepGo7fYkB+BpbtVmET90tDuFS2eGe mcoUlMt8Btb4YwWuT35730wE+Vkr2hgevBXjM/1kG/6tvJs7xVN/U5/jRvnF896FEU1h YXBN825c0o6cSLZ1fNlmUz2ZJB5fPNk6PRAXPL8FWoFj5OMb1eALXfdLmHDZ7xL6iua7 kEWxtuAc4wPUN6YX+oQ+sXt/PFRPDddufSSykM+0Vv2r9aCgUsqmf7BAgd3yr/LNoxf8 Utu2JUjw6eKkoqhSh+DJXH98RO/zj2O9YMN+n+FL9OttPRzTlI6FoeJCWQsqxy1pDa/Z /6wg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:sender:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=jFSlrwhSNYdvG/yNy2uTvylBzygUJgKaeyqO8xrGTTM=; b=U9qzIAET2cqXTK0tJ6I/jXrv3hIaLBQB2H+QzWH0yyIv9uxTJzD1FFAu6OGYhyahbg 2L6GTClNtVPfU/mmAaSy9TbZFBG7/leAdCXL5WyfQ+psXwxk1z+EqWNPN3/9gSHiGDqy JGXKAdWArtnluqHbCt0NSn0zD3UZalrpszl/eQRrBmee4L9MVQl2rUk1VVhKwzCez5RM XfW+fd9bLyHzITOgKf7LqWl9QG8f73zMQDGnEfAOJruw4mvr/7FpOXB7e6ukcjP3yuIo XPyXhxQ/Vey1RI4vS2wovlO3ddFUh7L7Ai4yLov5kgS+jyxubY7Nxm0w+0ztNLveeQLE ak4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=q4NLqHgm; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from mail.openembedded.org (mail.openembedded.org. [140.211.169.62]) by mx.google.com with ESMTP id j5si7229793pjf.60.2019.07.21.07.27.52; Sun, 21 Jul 2019 07:27:53 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) client-ip=140.211.169.62; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=q4NLqHgm; spf=pass (google.com: best guess record for domain of openembedded-core-bounces@lists.openembedded.org designates 140.211.169.62 as permitted sender) smtp.mailfrom=openembedded-core-bounces@lists.openembedded.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from ec2-34-214-78-129.us-west-2.compute.amazonaws.com (localhost [127.0.0.1]) by mail.openembedded.org (Postfix) with ESMTP id B921B7EF22; Sun, 21 Jul 2019 14:26:31 +0000 (UTC) X-Original-To: openembedded-core@lists.openembedded.org Delivered-To: openembedded-core@lists.openembedded.org Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mail.openembedded.org (Postfix) with ESMTP id 8F3F97EE16 for ; Sun, 21 Jul 2019 14:25:34 +0000 (UTC) Received: by mail-pf1-f176.google.com with SMTP id i189so16129964pfg.10 for ; Sun, 21 Jul 2019 07:25:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references; bh=i9A6RUbeHqED5lyBs1vAj2pf4izOS3Je3QrlVMcF2JU=; b=q4NLqHgm1m003U0Z9bk0xAj/q8h/H+bm5IJDLDd62ilEL3Z86/zLf7qIR9rrvCw0NH PO9wnEPPAcbxDOUN2SyNKyHB2WLBR/c4vb7fwh1exR+N885FmYUYUnh84bmyW0mn5x7e q+dUWBlPq5C4hHEvmLjt0FvprwZTM1hTQKAhJF52KlT30QZ/cCpdjWHmveUzW6subQKH tb5yy/Ylnjt4TbZWsCZu8T0Ws1fmLqYRcFgyNS8+QSWkeiIDTpz1PF3jkWJ9rHwPC95+ 4iXZw6+J19WuHeAgRxm2p5XsHOA7rejcRs2wkuTXMUAiY5o5XRI4hMAECFQAx4opxq+p IpIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=i9A6RUbeHqED5lyBs1vAj2pf4izOS3Je3QrlVMcF2JU=; b=GYjfT5bVlzLqkq37UMe2uEljB70x1BwOP/sc6mXZ8nXFRJ23sdNSO4lR86ZmdNObj2 qC5vXd+H1+30XjVVWNVAZnDa+MXRO6fJdYuBBboql6fb0qySkAbi4MPQaGA2uHTOrqf0 Ec6Y15v1QaHfSAJPvyd+TE0I6GLx8LLWxFy83+N+eRlDQ8ggKd/I12V3+pbLtHFQb4MW XFKX/I5fC8HfViWCMEW5sLTD/1THtI3HbD67qPWJmoXT6DPw2kD6kHGYXfqNoFGbnS4O vkQkABC0LWtS3M+Fbw2+NIklRAM+6Sp1BnEhOsLnhnpcbKLe0wNw1A8fXdQHRUCQ1eKY Vxpg== X-Gm-Message-State: APjAAAUFCRtDVNTMTCKodHvjS2KvqRJtOSi8ZxvygfsHfIzP0g/Uvqp+ nSXaJ4BCNisHUX95FYjEpTnbyy8f X-Received: by 2002:a63:4823:: with SMTP id v35mr39416605pga.138.1563719135247; Sun, 21 Jul 2019 07:25:35 -0700 (PDT) Received: from akuster-ThinkPad-T460s.hsd1.ca.comcast.net ([2601:202:4180:c33:bd4d:a6f4:da99:27b4]) by smtp.gmail.com with ESMTPSA id a3sm28807750pfc.70.2019.07.21.07.25.34 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 21 Jul 2019 07:25:34 -0700 (PDT) From: Armin Kuster To: openembedded-core@lists.openembedded.org Date: Sun, 21 Jul 2019 07:25:00 -0700 Message-Id: <8b5e68afc9767d8b6b966503e9353cadafae9bfb.1563719003.git.akuster808@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: References: Subject: [OE-core] [thud] 11/30] cairo: fix CVE-2018-19876 CVE-2019-6461 CVE-2019-6462 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: openembedded-core-bounces@lists.openembedded.org Errors-To: openembedded-core-bounces@lists.openembedded.org From: Ross Burton Source: OpenEmbedded.org MR: 97538, 97543 Type: Security Fix Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-graphics/cairo?h=warrior&id=078e4d5c2114d942806cd0d5ad501805a011e841 ChangeID: fa8bdd44ad8613bb0679a1f6d9d670c3b47a0677 Description: CVE-2018-19876 is a backport from upstream. CVE-2019-6461 and CVE-2019-6462 are patches taken from Clear Linux. Signed-off-by: Ross Burton Signed-off-by: Richard Purdie [Dropped CVE-2018-19876, not affected] Issue was introduced in 1.15.8 by: commit 721b7ea0a785afaa04b6da63f970c3c57666fdfe Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster --- .../recipes-graphics/cairo/cairo/CVE-2019-6461.patch | 19 +++++++++++++++++++ .../recipes-graphics/cairo/cairo/CVE-2019-6462.patch | 20 ++++++++++++++++++++ meta/recipes-graphics/cairo/cairo_1.14.12.bb | 2 ++ 3 files changed, 41 insertions(+) create mode 100644 meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch create mode 100644 meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch -- 2.7.4 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core diff --git a/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch b/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch new file mode 100644 index 0000000..5232cf7 --- /dev/null +++ b/meta/recipes-graphics/cairo/cairo/CVE-2019-6461.patch @@ -0,0 +1,19 @@ +There is a potential infinite-loop in function _arc_error_normalized(). + +CVE: CVE-2019-6461 +Upstream-Status: Pending +Signed-off-by: Ross Burton + +diff --git a/src/cairo-arc.c b/src/cairo-arc.c +index 390397bae..f9249dbeb 100644 +--- a/src/cairo-arc.c ++++ b/src/cairo-arc.c +@@ -99,7 +99,7 @@ _arc_max_angle_for_tolerance_normalized (double tolerance) + do { + angle = M_PI / i++; + error = _arc_error_normalized (angle); +- } while (error > tolerance); ++ } while (error > tolerance && error > __DBL_EPSILON__); + + return angle; + } diff --git a/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch b/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch new file mode 100644 index 0000000..4e4598c --- /dev/null +++ b/meta/recipes-graphics/cairo/cairo/CVE-2019-6462.patch @@ -0,0 +1,20 @@ +There is an assertion in function _cairo_arc_in_direction(). + +CVE: CVE-2019-6462 +Upstream-Status: Pending +Signed-off-by: Ross Burton + +diff --git a/src/cairo-arc.c b/src/cairo-arc.c +index 390397bae..1bde774a4 100644 +--- a/src/cairo-arc.c ++++ b/src/cairo-arc.c +@@ -186,7 +186,8 @@ _cairo_arc_in_direction (cairo_t *cr, + if (cairo_status (cr)) + return; + +- assert (angle_max >= angle_min); ++ if (angle_max < angle_min) ++ return; + + if (angle_max - angle_min > 2 * M_PI * MAX_FULL_CIRCLES) { + angle_max = fmod (angle_max - angle_min, 2 * M_PI); diff --git a/meta/recipes-graphics/cairo/cairo_1.14.12.bb b/meta/recipes-graphics/cairo/cairo_1.14.12.bb index 18b9479..08026c4 100644 --- a/meta/recipes-graphics/cairo/cairo_1.14.12.bb +++ b/meta/recipes-graphics/cairo/cairo_1.14.12.bb @@ -25,6 +25,8 @@ DEPENDS = "fontconfig glib-2.0 libpng pixman zlib" SRC_URI = "http://cairographics.org/releases/cairo-${PV}.tar.xz \ file://cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff \ file://0001-cairo-Fix-CVE-2017-9814.patch \ + file://CVE-2019-6461.patch \ + file://CVE-2019-6462.patch \ " SRC_URI[md5sum] = "9f0db9dbfca0966be8acd682e636d165"