Bug#1055944: bookworm-pu: package vips/8.14.1-3+deb12u1
Package: release.debian.org
User: release.debian.org@packages.debian.org
Usertags: pu
Tags: bookworm
Severity: normal
Control: affects -1 + src:vips
Hi RMs,
[ Reason ]
A specially crafted SVG input can cause libvips versions 8.14.3 or
earlier to segfault when attempting to parse a malformed UTF-8
character. It is considered a security issue and has the
CVE-2023-40032 identifier.
[ Impact ]
It is an application crash and can't be used for more. Hence the
Security Team decided it doesn't get a DSA. But it would be nice to
get the package updated.
[ Tests ]
Upstream testsuite and Sid update doesn't report any regressions.
[ Risks ]
The proposed change has very little risk of side-effects.
[ Checklist ]
[x] *all* changes are documents in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in bookworm
[x] the issue is verified as fixed in unstable
Thanks for considering,
Laszlo/GCS
diff -Nru vips-8.14.1/debian/changelog vips-8.14.1/debian/changelog
--- vips-8.14.1/debian/changelog 2023-02-13 10:48:58.000000000 +0100
+++ vips-8.14.1/debian/changelog 2023-11-14 16:05:39.000000000 +0100
@@ -1,3 +1,10 @@
+vips (8.14.1-3+deb12u1) bookworm; urgency=medium
+
+ * Backport upstream security fix for CVE-2023-40032: svgload: fix
+ null-pointer dereference.
+
+ -- Laszlo Boszormenyi (GCS) <gcs@debian.org> Tue, 14 Nov 2023 16:05:39 +0100
+
vips (8.14.1-3) unstable; urgency=medium
* Double self-testing timeout on mips64el and mipsel architectures.
diff -Nru vips-8.14.1/debian/patches/CVE-2023-40032.patch vips-8.14.1/debian/patches/CVE-2023-40032.patch
--- vips-8.14.1/debian/patches/CVE-2023-40032.patch 1970-01-01 01:00:00.000000000 +0100
+++ vips-8.14.1/debian/patches/CVE-2023-40032.patch 2023-11-14 16:05:39.000000000 +0100
@@ -0,0 +1,71 @@
+From e091d65835966ef56d53a4105a7362cafdb1582b Mon Sep 17 00:00:00 2001
+From: Kleis Auke Wolthuizen <github@kleisauke.nl>
+Date: Sun, 13 Aug 2023 15:48:54 +0200
+Subject: [PATCH] svgload: fix null-pointer dereference (#3604)
+
+`g_utf8_find_next_char()` might return NULL when called with a
+non-NULL second argument, indicating that the end of the string
+has been reached.
+---
+ ChangeLog | 4 ++++
+ libvips/foreign/svgload.c | 18 +++++++++++++++---
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index e47ee86bb4..b7544219e5 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,7 @@
++TBD 8.14.4
++
++- fix null-pointer dereference during svgload [kleisauke]
++
+ TBD 8.14.2
+
+ - dedupe FITS header write [ewelot]
+diff --git a/libvips/foreign/svgload.c b/libvips/foreign/svgload.c
+index 94072581d4..aefd412ed2 100644
+--- a/libvips/foreign/svgload.c
++++ b/libvips/foreign/svgload.c
+@@ -145,7 +145,7 @@ vips_foreign_load_svg_zfree( void *opaque, void *ptr )
+ /* Find a utf-8 substring within the first len_bytes (not characters).
+ *
+ * - case-insensitive
+- * - needle must be zero-terminated, but hackstack need not be
++ * - needle must be zero-terminated, but haystack need not be
+ * - haystack can be null-terminated
+ * - if haystack is shorter than len bytes, that'll end the search
+ * - if we hit invalid utf-8, we return NULL
+@@ -191,11 +191,14 @@ vips_utf8_strcasestr( const char *haystack_start, const char *needle_start,
+ b == (gunichar) -2 )
+ return( NULL );
+
+- /* End of haystack. There can't be a complete needle
+- * anywhere.
++ /* Disallow codepoint U+0000 as it's a nul byte.
++ * This is redundant with GLib >= 2.63.0, see:
++ * https://gitlab.gnome.org/GNOME/glib/-/merge_requests/967
+ */
++#if !GLIB_CHECK_VERSION( 2, 63, 0 )
+ if( a == (gunichar) 0 )
+ return( NULL );
++#endif
+
+ /* Mismatch.
+ */
+@@ -205,6 +208,15 @@ vips_utf8_strcasestr( const char *haystack_start, const char *needle_start,
+ haystack_char =
+ g_utf8_find_next_char( haystack_char,
+ haystack_start + len_bytes );
++
++ /* End of haystack. There can't be a complete needle
++ * anywhere.
++ */
++ if( haystack_char == NULL )
++ return( NULL );
++
++ /* needle_char will never be NULL.
++ */
+ needle_char =
+ g_utf8_find_next_char( needle_char, NULL );
+ }
diff -Nru vips-8.14.1/debian/patches/series vips-8.14.1/debian/patches/series
--- vips-8.14.1/debian/patches/series 2023-02-12 08:52:21.000000000 +0100
+++ vips-8.14.1/debian/patches/series 2023-11-14 16:05:39.000000000 +0100
@@ -1,2 +1,3 @@
dedupe_fits_header.patch
fix_target_pnm_write.patch
+CVE-2023-40032.patch
Reply to: