From 28e3cae483396a425496b0542eae7aa8a78d9905 Mon Sep 17 00:00:00 2001 From: Nathan Owens Date: Wed, 4 Dec 2019 13:41:09 -0600 Subject: [PATCH] fig2dev: add CVE-2019-19555 patch Signed-off-by: Nathan Owens --- srcpkgs/fig2dev/patches/CVE-2019-19555.patch | 42 ++++++++++++++++++++ srcpkgs/fig2dev/template | 6 +-- 2 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 srcpkgs/fig2dev/patches/CVE-2019-19555.patch diff --git a/srcpkgs/fig2dev/patches/CVE-2019-19555.patch b/srcpkgs/fig2dev/patches/CVE-2019-19555.patch new file mode 100644 index 0000000000..74406916d8 --- /dev/null +++ b/srcpkgs/fig2dev/patches/CVE-2019-19555.patch @@ -0,0 +1,42 @@ +-- fig2dev/read.c ++++fig2dev/read.c +@@ -3,7 +3,7 @@ + * Copyright (c) 1991 by Micah Beck + * Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul + * Parts Copyright (c) 1989-2015 by Brian V. Smith +- * Parts Copyright (c) 2015-2018 by Thomas Loimer ++ * Parts Copyright (c) 2015-2019 by Thomas Loimer + * + * Any party obtaining a copy of these files is granted, free of charge, a + * full and unrestricted irrevocable, world-wide, paid up, royalty-free, +@@ -1328,7 +1328,7 @@ + If we do not find the CONTROL-A on this line then this must + be a multi-line text object and we will have to read more. */ + +- n = sscanf(buf,"%*d%d%d%lf%d%d%d%lf%d%lf%lf%d%d%[^\1]%[\1]", ++ n = sscanf(buf,"%*d%d%d%lf%d%d%d%lf%d%lf%lf%d%d%[^\1]%1[\1]", + &t->type, &t->font, &t->size, &t->pen, + &t->color, &t->depth, &t->angle, + &t->flags, &t->height, &t->length, +--- fig2dev/tests/read.at ++++ fig2dev/tests/read.at +@@ -359,6 +359,17 @@ + ], 0, ignore) + AT_CLEANUP + ++AT_SETUP([allow text ending with multiple ^A, ticket #55]) ++AT_KEYWORDS([read.c]) ++AT_CHECK([fig2dev -L box <LICENSE