Package: gpac / 0.5.2-426-gc5ad4e4+dfsg5-5

CVE-2018-20760.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
From 4c1360818fc8948e9307059fba4dc47ba8ad255d Mon Sep 17 00:00:00 2001
From: Aurelien David <aurelien.david@telecom-paristech.fr>
Date: Thu, 13 Dec 2018 14:39:21 +0100
Subject: [PATCH] check error code on call to gf_utf8_wcstombs (#1177)

--- gpac-0.5.2-426-gc5ad4e4+dfsg5.orig/src/media_tools/text_import.c
+++ gpac-0.5.2-426-gc5ad4e4+dfsg5/src/media_tools/text_import.c
@@ -259,6 +259,8 @@ char *gf_text_get_utf8_line(char *szLine
 	}
 	sptr = (u16 *)szLine;
 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	if (i >= (u32)ARRAY_LENGTH(szLineConv))
+		return NULL;
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/