0018-Fix-buffer-overflow-in-exsltDateFormat.patch 895 B

123456789101112131415161718192021222324252627282930313233
  1. From 5d0c6565bab5b9b7efceb33b626916d22b4101a7 Mon Sep 17 00:00:00 2001
  2. From: Nick Wellnhofer <wellnhofer@aevum.de>
  3. Date: Thu, 28 Apr 2016 17:34:27 +0200
  4. Subject: [PATCH] Fix buffer overflow in exsltDateFormat
  5. Long years can overflow a stack-based buffer on 64-bit platforms by
  6. up to four bytes.
  7. Thanks to Nicolas Gregoire for the report.
  8. Fixes bug #765380:
  9. https://bugzilla.gnome.org/show_bug.cgi?id=765380
  10. ---
  11. libexslt/date.c | 2 +-
  12. 1 file changed, 1 insertion(+), 1 deletion(-)
  13. diff --git a/libexslt/date.c b/libexslt/date.c
  14. index 272c61b..12c9919 100644
  15. --- a/libexslt/date.c
  16. +++ b/libexslt/date.c
  17. @@ -1283,7 +1283,7 @@ exsltDateFormat (const exsltDateValPtr dt)
  18. }
  19. if (dt->type & XS_GYEAR) {
  20. - xmlChar buf[20], *cur = buf;
  21. + xmlChar buf[100], *cur = buf;
  22. FORMAT_GYEAR(dt->value.date.year, cur);
  23. if (dt->type == XS_GYEARMONTH) {
  24. --
  25. 2.8.1