[icu] Resolves: rhbz#766542 CVE-2011-4599 Stack-based buffer overflow
Eike Rathke
erack at fedoraproject.org
Tue Dec 13 19:09:18 UTC 2011
commit af25243294c43eb1ed58a50e0c705f518dce4da1
Author: Eike Rathke <erack at redhat.com>
Date: Tue Dec 13 20:00:41 2011 +0100
Resolves: rhbz#766542 CVE-2011-4599 Stack-based buffer overflow
icu.8984.CVE-2011-4599.patch | 20 ++++++++++++++++++++
icu.spec | 8 +++++++-
2 files changed, 27 insertions(+), 1 deletions(-)
---
diff --git a/icu.8984.CVE-2011-4599.patch b/icu.8984.CVE-2011-4599.patch
new file mode 100644
index 0000000..fc5fd63
--- /dev/null
+++ b/icu.8984.CVE-2011-4599.patch
@@ -0,0 +1,20 @@
+--- icu/source/common/uloc.c
++++ icu/source/common/uloc.c
+@@ -1797,7 +1797,7 @@
+ int32_t variantLen = _deleteVariant(variant, uprv_min(variantSize, (nameCapacity-len)), variantToCompare, n);
+ len -= variantLen;
+ if (variantLen > 0) {
+- if (name[len-1] == '_') { /* delete trailing '_' */
++ if (len > 0 && name[len-1] == '_') { /* delete trailing '_' */
+ --len;
+ }
+ addKeyword = VARIANT_MAP[j].keyword;
+@@ -1805,7 +1805,7 @@
+ break;
+ }
+ }
+- if (name[len-1] == '_') { /* delete trailing '_' */
++ if (len > 0 && len <= nameCapacity && name[len-1] == '_') { /* delete trailing '_' */
+ --len;
+ }
+ }
diff --git a/icu.spec b/icu.spec
index 7359112..a9f3482 100644
--- a/icu.spec
+++ b/icu.spec
@@ -1,6 +1,6 @@
Name: icu
Version: 4.8.1
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: International Components for Unicode
Group: Development/Tools
License: MIT and UCD and Public Domain
@@ -13,6 +13,7 @@ Requires: lib%{name} = %{version}-%{release}
Patch1: icu.8198.revert.icu5431.patch
Patch2: icu.8800.freeserif.crash.patch
Patch3: icu.7601.Indic-ccmp.patch
+Patch4: icu.8984.CVE-2011-4599.patch
%description
Tools and utilities for developing with icu.
@@ -55,6 +56,7 @@ BuildArch: noarch
%patch1 -p2 -R -b .icu8198.revert.icu5431.patch
%patch2 -p1 -b .icu8800.freeserif.crash.patch
%patch3 -p1 -b .icu7601.Indic-ccmp.patch
+%patch4 -p1 -b .icu8984.CVE-2011-4599.patch
%build
cd source
@@ -142,6 +144,10 @@ rm -rf $RPM_BUILD_ROOT
%doc source/__docs/%{name}/html/*
%changelog
+* Tue Dec 13 2011 Eike Rathke <erack at redhat.com> - 4.8.1-3
+- Resolves: rhbz#766542 CVE-2011-4599 Stack-based buffer overflow
+- add icu.8984.CVE-2011-4599.patch
+
* Mon Oct 24 2011 Caolán McNamara <caolanm at redhat.com> - 4.8.1-2
- Resolves: rhbz#747193 try and enable ccmp for Indic fonts
More information about the scm-commits
mailing list