gnu/packages/patches/glib-CVE-2021-27219-05.patch

   1 From 0cbad673215ec8a049b7fe2ff44b0beed31b376e Mon Sep 17 00:00:00 2001
   2 From: Philip Withnall <pwithnall@endlessos.org>
   3 Date: Thu, 4 Feb 2021 16:12:24 +0000
   4 Subject: [PATCH 05/11] gwinhttpfile: Avoid arithmetic overflow when
   5  calculating a size
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 The members of `URL_COMPONENTS` (`winhttp_file->url`) are `DWORD`s, i.e.
  11 32-bit unsigned integers. Adding to and multiplying them may cause them
  12 to overflow the unsigned integer bounds, even if the result is passed to
  13 `g_memdup2()` which accepts a `gsize`.
  14
  15 Cast the `URL_COMPONENTS` members to `gsize` first to ensure that the
  16 arithmetic is done in terms of `gsize`s rather than unsigned integers.
  17
  18 Spotted by Sebastian Dröge.
  19
  20 Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
  21 Helps: #2319
  22 ---
  23  gio/win32/gwinhttpfile.c | 8 ++++----
  24  1 file changed, 4 insertions(+), 4 deletions(-)
  25
  26 diff --git a/gio/win32/gwinhttpfile.c b/gio/win32/gwinhttpfile.c
  27 index 040ee8564..246ec0578 100644
  28 --- a/gio/win32/gwinhttpfile.c
  29 +++ b/gio/win32/gwinhttpfile.c
  30 @@ -394,10 +394,10 @@ g_winhttp_file_resolve_relative_path (GFile      *file,
  31    child = g_object_new (G_TYPE_WINHTTP_FILE, NULL);
  32    child->vfs = winhttp_file->vfs;
  33    child->url = winhttp_file->url;
  34 -  child->url.lpszScheme = g_memdup2 (winhttp_file->url.lpszScheme, (winhttp_file->url.dwSchemeLength+1)*2);
  35 -  child->url.lpszHostName = g_memdup2 (winhttp_file->url.lpszHostName, (winhttp_file->url.dwHostNameLength+1)*2);
  36 -  child->url.lpszUserName = g_memdup2 (winhttp_file->url.lpszUserName, (winhttp_file->url.dwUserNameLength+1)*2);
  37 -  child->url.lpszPassword = g_memdup2 (winhttp_file->url.lpszPassword, (winhttp_file->url.dwPasswordLength+1)*2);
  38 +  child->url.lpszScheme = g_memdup2 (winhttp_file->url.lpszScheme, ((gsize) winhttp_file->url.dwSchemeLength + 1) * 2);
  39 +  child->url.lpszHostName = g_memdup2 (winhttp_file->url.lpszHostName, ((gsize) winhttp_file->url.dwHostNameLength + 1) * 2);
  40 +  child->url.lpszUserName = g_memdup2 (winhttp_file->url.lpszUserName, ((gsize) winhttp_file->url.dwUserNameLength + 1) * 2);
  41 +  child->url.lpszPassword = g_memdup2 (winhttp_file->url.lpszPassword, ((gsize) winhttp_file->url.dwPasswordLength + 1) * 2);
  42    child->url.lpszUrlPath = wnew_path;
  43    child->url.dwUrlPathLength = wcslen (wnew_path);
  44    child->url.lpszExtraInfo = NULL;
  45 --
  46 2.30.1
  47