diff -u clamav-0.92.1~dfsg2/debian/changelog clamav-0.92.1~dfsg2/debian/changelog --- clamav-0.92.1~dfsg2/debian/changelog +++ clamav-0.92.1~dfsg2/debian/changelog @@ -1,3 +1,14 @@ +clamav (0.92.1~dfsg2-1.1~gutsy3.1) gutsy-security; urgency=low + + * SECURITY UPDATE: fix possible DoS due to invalid memory access + * Updated 27_petite.c.dpatch (LP: #249316) + - libclamav/petite.c: fix one more spot + * References + CVE-2008-2713 + Debian Bug #490925 + + -- Michael Casadevall Thu, 17 Jul 2008 05:25:10 +0000 + clamav (0.92.1~dfsg2-1.1~gutsy3) gutsy-security; urgency=low * SECURITY UPDATE: fix possible invalid memory access diff -u clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch --- clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch +++ clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch @@ -6,8 +6,8 @@ @DPATCH@ diff -urNad clamav-0.92.1~dfsg2~/libclamav/petite.c clamav-0.92.1~dfsg2/libclamav/petite.c ---- clamav-0.92.1~dfsg2~/libclamav/petite.c 2007-12-06 05:59:04.000000000 -0700 -+++ clamav-0.92.1~dfsg2/libclamav/petite.c 2008-06-09 12:07:41.000000000 -0600 +--- clamav-0.92.1~dfsg2~/libclamav/petite.c 2007-12-06 12:59:04.000000000 +0000 ++++ clamav-0.92.1~dfsg2/libclamav/petite.c 2008-07-17 05:30:36.000000000 +0000 @@ -1,5 +1,7 @@ /* - * Copyright (C) 2004 aCaB @@ -17,7 +17,23 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as -@@ -263,6 +265,7 @@ +@@ -212,8 +214,14 @@ + /* Let's compact data */ + for (t = 0; t < j ; t++) { + usects[t].raw = (t>0)?(usects[t-1].raw + usects[t-1].rsz):0; +- if (usects[t].rsz != 0 && CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) ++ if (usects[t].rsz != 0) ++ if(CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) { + memmove(buf + usects[t].raw, adjbuf + usects[t].rva, usects[t].rsz); ++ } else { ++ cli_dbgmsg("Petite: Skipping section %d, Raw: %x, RSize:%x\n", t, usects[t].raw, usects[t].rsz); ++ usects[t].raw = t>0 ? usects[t-1].raw : 0; ++ usects[t].rsz = 0; ++ } + } + + /* Showtime!!! */ +@@ -263,6 +271,7 @@ uint32_t check1, check2; uint8_t mydl = 0; uint8_t goback; @@ -25,7 +41,7 @@ /* Unpak each original section in turn */ -@@ -310,15 +313,18 @@ +@@ -310,15 +319,18 @@ * (eg the icon): let's fix the rva */