diff -u clamav-0.92.1~dfsg2/debian/changelog clamav-0.92.1~dfsg2/debian/changelog --- clamav-0.92.1~dfsg2/debian/changelog +++ clamav-0.92.1~dfsg2/debian/changelog @@ -1,3 +1,14 @@ +clamav (0.92.1~dfsg2-1.1~feisty3.1) feisty-security; urgency=low + + * SECURITY UPDATE: fix possible DoS due to invalid memory access + * Updated 27_petite.c.dpatch (LP: #249316) + - libclamav/petite.c: fix one more spot + * References + CVE-2008-2713 + Debian Bug #490925 + + -- Michael Casadevall Thu, 17 Jul 2008 06:03:13 +0000 + clamav (0.92.1~dfsg2-1.1~feisty3) feisty-security; urgency=low * SECURITY UPDATE: fix possible invalid memory access diff -u clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch --- clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch +++ clamav-0.92.1~dfsg2/debian/patches/27_petite.c.dpatch @@ -1,13 +1,13 @@ #! /bin/sh /usr/share/dpatch/dpatch-run -## 27_petite.c.dpatch by Leonel Nunez +## 27_petite.c.dpatch by ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: No description. @DPATCH@ diff -urNad clamav-0.92.1~dfsg2~/libclamav/petite.c clamav-0.92.1~dfsg2/libclamav/petite.c ---- clamav-0.92.1~dfsg2~/libclamav/petite.c 2007-12-06 05:59:04.000000000 -0700 -+++ clamav-0.92.1~dfsg2/libclamav/petite.c 2008-06-09 19:05:43.000000000 -0600 +--- clamav-0.92.1~dfsg2~/libclamav/petite.c 2007-12-06 07:59:04.000000000 -0500 ++++ clamav-0.92.1~dfsg2/libclamav/petite.c 2008-07-17 00:40:16.000000000 -0400 @@ -1,5 +1,7 @@ /* - * Copyright (C) 2004 aCaB @@ -17,7 +17,24 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as -@@ -263,6 +265,7 @@ +@@ -212,8 +214,14 @@ + /* Let's compact data */ + for (t = 0; t < j ; t++) { + usects[t].raw = (t>0)?(usects[t-1].raw + usects[t-1].rsz):0; +- if (usects[t].rsz != 0 && CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) +- memmove(buf + usects[t].raw, adjbuf + usects[t].rva, usects[t].rsz); ++ if (usects[t].rsz != 0) ++ if(CLI_ISCONTAINED(buf, bufsz, buf + usects[t].raw, usects[t].rsz)) { ++ memmove(buf + usects[t].raw, adjbuf + usects[t].rva, usects[t].rsz); ++ } else { ++ cli_dbgmsg("Petite: Skipping section %d, Raw: %x, RSize:%x\n", t, usects[t].raw, usects[t].rsz); ++ usects[t].raw = t>0 ? usects[t-1].raw : 0; ++ usects[t].rsz = 0; ++ } + } + + /* Showtime!!! */ +@@ -263,6 +271,7 @@ uint32_t check1, check2; uint8_t mydl = 0; uint8_t goback; @@ -25,7 +42,7 @@ /* Unpak each original section in turn */ -@@ -310,15 +313,18 @@ +@@ -310,15 +319,18 @@ * (eg the icon): let's fix the rva */