diff options
author | Joe Slater <joe.slater@windriver.com> | 2021-07-22 09:39:38 -0700 |
---|---|---|
committer | Armin Kuster <akuster808@gmail.com> | 2021-07-27 22:36:24 -0700 |
commit | 88813d34dd665cf90403716b88db2f0e0ec78d76 (patch) | |
tree | d194ba6d2f3f3eac03baed798222f712217c3e33 /meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch | |
parent | 76a6070e6886fc7d623742bf0f7c4167b8b8dae8 (diff) | |
download | meta-openembedded-88813d34dd665cf90403716b88db2f0e0ec78d76.tar.gz |
python3-pillow: fix CVE-2021-34552
Pull fix from version 8.3.1 back to 8.2.0.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
Diffstat (limited to 'meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch')
-rw-r--r-- | meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch b/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch new file mode 100644 index 0000000000..fc0337f137 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch @@ -0,0 +1,43 @@ +From 518ee3722a99d7f7d890db82a20bd81c1c0327fb Mon Sep 17 00:00:00 2001 +From: Andrew Murray <radarhere@users.noreply.github.com> +Date: Wed, 30 Jun 2021 23:47:10 +1000 +Subject: [PATCH 1/1] Use snprintf instead of sprintf + +Fix CVE-2021-34552. + +commit 518ee3722a99d7f7d890db82a20bd81c1c0327fb (unmodified) + +Upstream-Status: Backport +Signed-off-by: Joe Slater <joe.slater@windriver.com> + +--- + src/libImaging/Convert.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c +index 1fa74a13b..9012cfcd7 100644 +--- a/src/libImaging/Convert.c ++++ b/src/libImaging/Convert.c +@@ -1595,7 +1595,7 @@ convert( + return (Imaging)ImagingError_ValueError("conversion not supported"); + #else + static char buf[100]; +- sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode); ++ snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode); + return (Imaging)ImagingError_ValueError(buf); + #endif + } +@@ -1645,8 +1645,9 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) { + #else + { + static char buf[100]; +- sprintf( ++ snprintf( + buf, ++ 100, + "conversion from %.10s to %.10s not supported in convert_transparent", + imIn->mode, + mode); +-- +2.29.2 + |