From bc0288b76816578f5aeccb2abd679f82bfc5738e Mon Sep 17 00:00:00 2001 From: Robert Marko Date: Tue, 12 May 2020 22:18:33 +0200 Subject: libjson-c: backport security fixes This backports upstream fixes for the out of bounds write vulnerability in json-c. It was reported and patches in this upstream PR: https://github.com/json-c/json-c/pull/592 Addresses CVE-2020-12762 Signed-off-by: Robert Marko Signed-off-by: Luka Perkov [bump PKG_RELEASE] Signed-off-by: Jo-Philipp Wich --- ...ix-the-backwards-check-in-lh_table_insert.patch | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 package/libs/libjson-c/patches/004-Issue-599-Fix-the-backwards-check-in-lh_table_insert.patch (limited to 'package/libs/libjson-c/patches/004-Issue-599-Fix-the-backwards-check-in-lh_table_insert.patch') diff --git a/package/libs/libjson-c/patches/004-Issue-599-Fix-the-backwards-check-in-lh_table_insert.patch b/package/libs/libjson-c/patches/004-Issue-599-Fix-the-backwards-check-in-lh_table_insert.patch new file mode 100644 index 0000000000..aed6918e70 --- /dev/null +++ b/package/libs/libjson-c/patches/004-Issue-599-Fix-the-backwards-check-in-lh_table_insert.patch @@ -0,0 +1,29 @@ +From 519dfe1591d85432986f9762d41d1a883198c157 Mon Sep 17 00:00:00 2001 +From: Eric Haszlakiewicz +Date: Sun, 10 May 2020 03:32:19 +0000 +Subject: [PATCH] Issue #599: Fix the backwards check in + lh_table_insert_w_hash() that was preventing adding more than 11 objects. Add + a test to check for this too. + +--- + linkhash.c | 2 +- + tests/test4.c | 29 +++++++++++++++++++++++++++++ + tests/test4.expected | 1 + + 3 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/linkhash.c b/linkhash.c +index 51e90b1..f930efd 100644 +--- a/linkhash.c ++++ b/linkhash.c +@@ -582,7 +582,7 @@ int lh_table_insert_w_hash(struct lh_table *t, const void *k, const void *v, con + + if (t->count >= t->size * LH_LOAD_FACTOR) { + /* Avoid signed integer overflow with large tables. */ +- int new_size = INT_MAX / 2 < t->size ? t->size * 2 : INT_MAX; ++ int new_size = (t->size > INT_MAX / 2) ? INT_MAX : (t->size * 2); + if (t->size == INT_MAX || lh_table_resize(t, new_size) != 0) + return -1; + } +-- +2.26.2 + -- cgit v1.2.3