Package: pillow / 8.1.2+dfsg-0.3

CVE-2021-34552.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
From 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Tue, 15 Jun 2021 15:14:26 +1000
Subject: [PATCH 1/2] Limit sprintf modes to 10 characters

From 518ee3722a99d7f7d890db82a20bd81c1c0327fb Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Wed, 30 Jun 2021 23:47:10 +1000
Subject: [PATCH 2/2] Use snprintf instead of sprintf

* https://github.com/python-pillow/Pillow/pull/5567/files
* Replace sprintf with snprintf in src/libImaging/Convert.c

---
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1664,9 +1664,8 @@
 #ifdef notdef
         return (Imaging) ImagingError_ValueError("conversion not supported");
 #else
-        static char buf[256];
-        /* FIXME: may overflow if mode is too large */
-        sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
+        static char buf[100];
+        snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
         return (Imaging) ImagingError_ValueError(buf);
 #endif
     }
@@ -1724,9 +1723,8 @@
     }
 #else
     {
-      static char buf[256];
-      /* FIXME: may overflow if mode is too large */
-      sprintf(buf, "conversion from %s to %s not supported in convert_transparent", imIn->mode, mode);
+      static char buf[100];
+      snprintf(buf, 100, "conversion from %.10s to %.10s not supported in convert_transparent", imIn->mode, mode);
       return (Imaging) ImagingError_ValueError(buf);
     }
 #endif