Bug#1091761: marked as done (bookworm-pu: package poco/1.11.0-3+deb12u1)

To: jmw@debian.org
Subject: Bug#1091761: marked as done (bookworm-pu: package poco/1.11.0-3+deb12u1)
From: "Debian Bug Tracking System" <owner@bugs.debian.org>
Date: Sat, 11 Jan 2025 11:06:41 +0000
Message-id: <[🔎] handler.1091761.D1091761.17365933952449470.ackdone@bugs.debian.org>
Reply-to: 1091761@bugs.debian.org
References: <E1tWZGn-009jaG-AP@coccia.debian.org> <173560064211.6507.9969102994008115218.reportbug@hullmann.westfalen.local>

Your message dated Sat, 11 Jan 2025 11:03:09 +0000
with message-id <E1tWZGn-009jaG-AP@coccia.debian.org>
and subject line Close 1091761
has caused the Debian Bug report #1091761,
regarding bookworm-pu: package poco/1.11.0-3+deb12u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1091761: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091761
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

--- Begin Message ---

To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: bookworm-pu: package poco/1.11.0-3+deb12u1
From: Moritz Muehlenhoff <jmm@debian.org>
Date: Tue, 31 Dec 2024 00:17:22 +0100
Message-id: <173560064211.6507.9969102994008115218.reportbug@hullmann.westfalen.local>

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: poco@packages.debian.org
Control: affects -1 + src:poco
User: release.debian.org@packages.debian.org
Usertags: pu

Fix for CVE-2023-52389 (which doesn't warrant a DSA),
debdiff below.

Cheers,
        Moritz

diff -Nru poco-1.11.0/debian/changelog poco-1.11.0/debian/changelog
--- poco-1.11.0/debian/changelog	2021-11-27 13:39:34.000000000 +0100
+++ poco-1.11.0/debian/changelog	2024-12-21 14:28:42.000000000 +0100
@@ -1,3 +1,9 @@
+poco (1.11.0-3+deb12u1) bookworm; urgency=medium
+
+  * CVE-2023-52389
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Sat, 21 Dec 2024 14:28:42 +0100
+
 poco (1.11.0-3) unstable; urgency=medium
 
   * Fix cmake files (Closes: #1000656)
diff -Nru poco-1.11.0/debian/patches/CVE-2023-52389.patch poco-1.11.0/debian/patches/CVE-2023-52389.patch
--- poco-1.11.0/debian/patches/CVE-2023-52389.patch	1970-01-01 01:00:00.000000000 +0100
+++ poco-1.11.0/debian/patches/CVE-2023-52389.patch	2024-12-21 14:28:26.000000000 +0100
@@ -0,0 +1,109 @@
+From 62f875dfe1298041289f926a6a1a39cb765b13ee Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=BCnter=20Obiltschnig?= <guenter.obiltschnig@appinf.com>
+Date: Mon, 4 Dec 2023 15:22:43 +0100
+Subject: [PATCH] #4320: Integer overflow in Poco::UTF32Encoding
+
+--- poco-1.11.0.orig/Foundation/include/Poco/UTF32Encoding.h
++++ poco-1.11.0/Foundation/include/Poco/UTF32Encoding.h
+@@ -68,6 +68,15 @@ public:
+ 	int convert(int ch, unsigned char* bytes, int length) const;
+ 	int queryConvert(const unsigned char* bytes, int length) const;
+ 	int sequenceLength(const unsigned char* bytes, int length) const;
++
++protected:
++	static int safeToInt(Poco::UInt32 value)
++	{
++		if (value <= 0x10FFFF)
++			return static_cast<int>(value);
++		else
++			return -1;
++	}
+ 	
+ private:
+ 	bool _flipBytes;
+--- poco-1.11.0.orig/Foundation/src/UTF32Encoding.cpp
++++ poco-1.11.0/Foundation/src/UTF32Encoding.cpp
+@@ -30,22 +30,22 @@ const char* UTF32Encoding::_names[] =
+ 
+ const TextEncoding::CharacterMap UTF32Encoding::_charMap =
+ {
+-	/* 00 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 10 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 20 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 30 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 40 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 50 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 60 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 70 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 80 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* 90 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* a0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* b0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* c0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* d0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* e0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
+-	/* f0 */	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
++	/* 00 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 10 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 20 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 30 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 40 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 50 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 60 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 70 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 80 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* 90 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* a0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* b0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* c0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* d0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* e0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
++	/* f0 */	-4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4, -4,
+ };
+ 
+ 
+@@ -118,7 +118,7 @@ const TextEncoding::CharacterMap& UTF32E
+ int UTF32Encoding::convert(const unsigned char* bytes) const
+ {
+ 	UInt32 uc;
+-	unsigned char* p = (unsigned char*) &uc;
++	unsigned char* p = reinterpret_cast<unsigned char*>(&uc);
+ 	*p++ = *bytes++;
+ 	*p++ = *bytes++;
+ 	*p++ = *bytes++;
+@@ -129,7 +129,7 @@ int UTF32Encoding::convert(const unsigne
+ 		uc = ByteOrder::flipBytes(uc);
+ 	}
+ 
+-	return uc;
++	return safeToInt(uc);
+ }
+ 
+ 
+@@ -138,7 +138,7 @@ int UTF32Encoding::convert(int ch, unsig
+ 	if (bytes && length >= 4)
+ 	{
+ 		UInt32 ch1 = _flipBytes ? ByteOrder::flipBytes((UInt32) ch) : (UInt32) ch;
+-		unsigned char* p = (unsigned char*) &ch1;
++		unsigned char* p = reinterpret_cast<unsigned char*>(&ch1);
+ 		*bytes++ = *p++;
+ 		*bytes++ = *p++;
+ 		*bytes++ = *p++;
+@@ -155,7 +155,7 @@ int UTF32Encoding::queryConvert(const un
+ 	if (length >= 4)
+ 	{
+ 		UInt32 uc;
+-		unsigned char* p = (unsigned char*) &uc;
++		unsigned char* p = reinterpret_cast<unsigned char*>(&uc);
+ 		*p++ = *bytes++;
+ 		*p++ = *bytes++;
+ 		*p++ = *bytes++;
+@@ -164,7 +164,7 @@ int UTF32Encoding::queryConvert(const un
+ 		{
+ 			uc = ByteOrder::flipBytes(uc);
+ 		}
+-		return uc;
++		ret = safeToInt(uc);
+ 	}
+ 
+ 	return ret;
diff -Nru poco-1.11.0/debian/patches/series poco-1.11.0/debian/patches/series
--- poco-1.11.0/debian/patches/series	2021-11-27 13:38:37.000000000 +0100
+++ poco-1.11.0/debian/patches/series	2024-12-21 14:27:51.000000000 +0100
@@ -8,3 +8,4 @@
 0011-Set-POCO_NO_FPENVIRONMENT-for-armel.patch
 0012-Disable-failing-tests.patch
 0010-fix-missing-expat-definition.patch
+CVE-2023-52389.patch

--- End Message ---

--- Begin Message ---

To: 1091761-done@bugs.debian.org

Subject: Close 1091761

From: jmw@debian.org

Date: Sat, 11 Jan 2025 11:03:09 +0000

Message-id: <E1tWZGn-009jaG-AP@coccia.debian.org>
Version: 12.9
This update has been released as part of 12.9. Thank you for your contribution.
--- End Message ---

Reply to:

Prev by Date: Bug#1091717: marked as done (bookworm-pu: package gst-plugins-base1.0/1.22.0-3+deb12u4)
Next by Date: Bug#1091784: marked as done (bookworm-pu: package cpuinfo/0.0~git20220617.082deff-1+deb12u1)
Previous by thread: Bug#1091717: marked as done (bookworm-pu: package gst-plugins-base1.0/1.22.0-3+deb12u4)
Next by thread: Bug#1091784: marked as done (bookworm-pu: package cpuinfo/0.0~git20220617.082deff-1+deb12u1)
Index(es):
- Date
- Thread