diff options
| author | fredb <fredb@pkgsrc.org> | 2004-05-10 01:15:14 +0000 |
|---|---|---|
| committer | fredb <fredb@pkgsrc.org> | 2004-05-10 01:15:14 +0000 |
| commit | a6b9f4a80fb96a9f5136d86f3c3f0ab71e02acb5 (patch) | |
| tree | 42e75f50f077c5112d02c38648a833ab8f4f163a /security | |
| parent | c28674490098f301fa9f57002fb45abae5666bf1 (diff) | |
| download | pkgsrc-a6b9f4a80fb96a9f5136d86f3c3f0ab71e02acb5.tar.gz | |
Don't read past the end of the error message string. This patch was
posted to png-implement by Glenn Randers-Pherson, libpng's maintainer.
This error was widely reported as "security issue",
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0421
even though there is no security issue. The most the error could do is
SIGSEGV, and that only with some fairly uncommon circumstances. The patch
posted with the advisory is in fact flawed, in that it calls strlen() on
presumably arbitrary data.
Bump PKGREVISION.
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions