开源软件构建与测试

_service:tar_scm:libexif.spec Changed

_service:tar_scm:backport-fuzz-stack-overflow.patch Added

@@ -0,0 +1,34 @@
+From 49a74b371c322a1e55e242a230a7bb577ebe065b Mon Sep 17 00:00:00 2001
+From: Marcus Meissner <marcus@jet.franken.de>
+Date: Mon, 6 Sep 2021 08:42:56 +0200
+Subject: PATCH replace tail recursion by direct loop, in case the compiler
+ does not translate it into a tail recursion it could be used to cause stack
+ overruns (oss-fuzz)
+
+---
+ libexif/exif-loader.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libexif/exif-loader.c b/libexif/exif-loader.c
+index e376465..5c48faf 100644
+--- a/libexif/exif-loader.c
++++ b/libexif/exif-loader.c
+@@ -154,6 +154,7 @@ exif_loader_write (ExifLoader *eld, unsigned char *buf, unsigned int len)
+ {
+ 	unsigned int i;
+ 
++begin:
+ 	if (!eld || (len && !buf)) 
+ 		return 0;
+ 
+@@ -310,7 +311,7 @@ exif_loader_write (ExifLoader *eld, unsigned char *buf, unsigned int len)
+ 	 * to read all data we need. Fill it with new data.
+ 	 */
+ 	eld->b_len = 0;
+-	return exif_loader_write (eld, buf, len);
++	goto begin;
+ }
+ 
+ ExifLoader *
+-- 
+2.27.0

_service:tar_scm:backport-fuzz-timeout-and-out-of-memory.patch Added

@@ -0,0 +1,38 @@
+From e93be918878ab98ee45430858e96cb302ffee2bc Mon Sep 17 00:00:00 2001
+From: Marcus Meissner <marcus@jet.franken.de>
+Date: Sat, 30 Jan 2021 14:06:08 +0100
+Subject: PATCH limit the amount of tags we allow in the makernote here.
+
+due to memory layout the max amount of 65536 tags could be used
+to exhaust lots of memory and time during parsing,
+as each tag can reuse the same memory range.
+
+(Memory usage DOS (2GB+) and compute dos (several minutes on fast machine, but not endless))
+
+This fixes OSS-FUZZ issue 27280.
+
+https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27280
+---
+ libexif/olympus/exif-mnote-data-olympus.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c
+index 45e4bc5..0c68d51 100644
+--- a/libexif/olympus/exif-mnote-data-olympus.c
++++ b/libexif/olympus/exif-mnote-data-olympus.c
+@@ -419,6 +419,13 @@ exif_mnote_data_olympus_load (ExifMnoteData *en,
+ 	c = exif_get_short (buf + o2, n->order);
+ 	o2 += 2;
+ 
++	/* Just use an arbitrary max tag limit here to avoid needing to much memory or time. There are 150 named tags currently.
++	 * The format allows specifying the same range of memory as often as it can, so this multiplies quickly. */
++	if (c > 300) {
++		exif_log (en->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifMnoteOlympus", "Too much tags (%d) in Olympus MakerNote", c);
++		return;
++	}
++
+ 	/* Remove any old entries */
+ 	exif_mnote_data_olympus_clear (n);
+ 
+-- 
+2.27.0

_service Changed

Changes of Revision 2