diff -u clamav-0.92.1~dfsg2/debian/changelog clamav-0.92.1~dfsg2/debian/changelog --- clamav-0.92.1~dfsg2/debian/changelog +++ clamav-0.92.1~dfsg2/debian/changelog @@ -1,3 +1,14 @@ +clamav (0.92.1~dfsg2-1.1~feisty4) feisty-security; urgency=low + + * SECURITY UPDATE: fix possible DoS due to invalid memory access + * References + CVE-2008-2713 + Debian Bug #490925 + * Updated 27_petite.c.dpatch (LP: #249316) + - libclamav/petite.c: fix one more spot + + -- Michael Casadevall Thu, 17 Jul 2008 06:03:13 +0000 + clamav (0.92.1~dfsg2-1.1~feisty3) feisty-security; urgency=low * SECURITY UPDATE: fix possible invalid memory access diff -u clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch --- clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch +++ clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch @@ -17,6 +17,22 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as +@@ -212,8 +214,14 @@ + /* Let's compact data */ + for (t = 0; t < j ; t++) { + usects[t].raw = (t>0)?(usects[t-1].raw + usects[t-1].rsz):0; +- if (usects[t].rsz != 0 && CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) ++ if (usects[t].rsz != 0) ++ if(CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) { + memmove(buf + usects[t].raw, adjbuf + usects[t].rva, usects[t].rsz); ++ } else { ++ cli_dbgmsg("Petite: Skipping section %d, Raw: %x, RSize:%x\n", t, usects[t].raw, usects[t].rsz); ++ usects[t].raw = t>0 ? usects[t-1].raw : 0; ++ usects[t].rsz = 0; ++ } + } + + /* Showtime!!! */ @@ -263,6 +265,7 @@ uint32_t check1, check2; uint8_t mydl = 0;