diff -u clamav-0.92.1~dfsg2/debian/changelog clamav-0.92.1~dfsg2/debian/changelog --- clamav-0.92.1~dfsg2/debian/changelog +++ clamav-0.92.1~dfsg2/debian/changelog @@ -1,3 +1,11 @@ +clamav (0.92.1~dfsg2-1.1~gutsy2ubuntu1) gutsy-security; urgency=low + + * SECURITY UPDATE: fix possible invalid memory access + * libclamav/petite.c : fix possible invalid memory access + * added 27_petite.c.dpatch: Fixes ( LP #238575 ) + + -- Leonel Nunez Mon, 09 Jun 2008 12:10:04 -0600 + clamav (0.92.1~dfsg2-1.1~gutsy2) gutsy-security; urgency=low * no change rebuild for -security only in patch2: unchanged: --- clamav-0.92.1~dfsg2.orig/debian/patches/27_petite.c.dpatch +++ clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch @@ -0,0 +1,52 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 27_petite.c.dpatch by Leonel Nunez +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad clamav-0.92.1~dfsg2~/libclamav/petite.c clamav-0.92.1~dfsg2/libclamav/petite.c +--- clamav-0.92.1~dfsg2~/libclamav/petite.c 2007-12-06 05:59:04.000000000 -0700 ++++ clamav-0.92.1~dfsg2/libclamav/petite.c 2008-06-09 12:07:41.000000000 -0600 +@@ -1,5 +1,7 @@ + /* +- * Copyright (C) 2004 aCaB ++ * Copyright (C) 2007-2008 Sourcefire, Inc. ++ * ++ * Authors: Alberto Wu + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -263,6 +265,7 @@ + uint32_t check1, check2; + uint8_t mydl = 0; + uint8_t goback; ++ unsigned int q; + + /* Unpak each original section in turn */ + +@@ -310,15 +313,18 @@ + * (eg the icon): let's fix the rva + */ + +- if (!check4resources) { +- unsigned int q; +- for ( q = 0 ; q < sectcount ; q++ ) { +- if ( thisrva <= sections[q].rva || thisrva >= sections[q].rva + sections[q].vsz) +- continue; ++ for ( q = 0 ; q < sectcount ; q++ ) { ++ if(!CLI_ISCONTAINED(sections[q].rva, sections[q].vsz, usects[j].rva, usects[j].vsz)) ++ continue; ++ if (!check4resources) { + usects[j].rva = sections[q].rva; + usects[j].rsz = thisrva - sections[q].rva + size; +- break; + } ++ break; ++ } ++ if (q == sectcount) { ++ free(usects); ++ return 1; + } + + /* Increase count of unpacked sections */