Re: Patch for CVE-2018-7490 in uwsgi

2018-03-18 Thread Abhijith PA
On Sunday 18 March 2018 06:40 PM, Gero Treuner wrote: [..] >> +// fix docroot >> +if (uphp.docroot) { >> +char *orig_docroot = uphp.docroot; >> +uphp.docroot = uwsgi_expand_path(uphp.docroot, >> strlen(uphp.docroot), NULL); >> +if (!uphp.docroot) { >>

Re: Patch for CVE-2018-7490 in uwsgi

2018-03-18 Thread Gero Treuner
Hi Abhijith, On Sun, Mar 18, 2018 at 05:13:53PM +0530, Abhijith PA wrote: > Thanks for the patch :) Thanks for looking at it :-) > It look like ( and also you mentioned) you have added following lines > from master branch. But I don't see the point of doing these other > than that the upstream pa

Re: Patch for CVE-2018-7490 in uwsgi

2018-03-18 Thread Abhijith PA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi. Gero Treuner On Sunday 18 March 2018 02:32 PM, Gero Treuner wrote: > Hi all, > > Attached is a wheezy patch for a security issue: > https://security-tracker.debian.org/tracker/CVE-2018-7490 > Thanks for the patch :) > The upstream patch was

Patch for CVE-2018-7490 in uwsgi

2018-03-18 Thread Gero Treuner
Hi all, Attached is a wheezy patch for a security issue: https://security-tracker.debian.org/tracker/CVE-2018-7490 The upstream patch was backported, and source code apparently didn't change much. Only a small section (~10 lines) from the current uwsgi had to be added additionally. It build and

Re: tiff / CVE-2018-7456

2018-03-18 Thread Hugo Lefeuvre
Hi Brian, > > So, in fact it may very well be that the size of the TransferFunction table > > is always at most 3 rows and this definition is right. > > Is the code that loads the transfer function safe? Is there any > possibility of tricking the loading function to try and set the 4th row? Hum,

Re: tiff / CVE-2018-7456

2018-03-18 Thread Hugo Lefeuvre
> Seems good to me. I would suggest sending a patch upstream, see what > they think. Thanks for the feedback ! I'll write the remaining part and submit it to upstream. > Also I tend to think some some of assertion might be a good idea, > something that aborts if > > (td->td_samplesperpixel - td