python-pillow/backport-0001-CVE-2021-34552.patch
2021-07-15 15:57:44 +08:00

44 lines
1.6 KiB
Diff

From 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Tue, 15 Jun 2021 15:14:26 +1000
Subject: [PATCH] Limit sprintf modes to 10 characters
Conflict:NA
Reference:https://github.com/python-pillow/Pillow/commit/5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97
---
src/libImaging/Convert.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
index b0b794d..64bbeee 100644
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1664,9 +1664,8 @@ convert(Imaging imOut, Imaging imIn, const char *mode,
#ifdef notdef
return (Imaging) ImagingError_ValueError("conversion not supported");
#else
- static char buf[256];
- /* FIXME: may overflow if mode is too large */
- sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
+ static char buf[100];
+ sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
return (Imaging) ImagingError_ValueError(buf);
#endif
}
@@ -1724,9 +1723,8 @@ ImagingConvertTransparent(Imaging imIn, const char *mode,
}
#else
{
- static char buf[256];
- /* FIXME: may overflow if mode is too large */
- sprintf(buf, "conversion from %s to %s not supported in convert_transparent", imIn->mode, mode);
+ static char buf[100];
+ sprintf(buf, "conversion from %.10s to %.10s not supported in convert_transparent", imIn->mode, mode);
return (Imaging) ImagingError_ValueError(buf);
}
#endif
--
2.27.0