Bug#342292: tetex-bin: Multiple exploitable heap overflows in embedded xpdf copy
Hi!
Frank Küster [2005-12-11 13:27 +0100]:
> >> Did you see Martin Pitt's "enhanced" patch - do both address the same
> >> problems?
> >
> > The appendix removes the douplette Martin found, so yes.
>
> I looked at both, and it seems that Martin's does more. I'm speaking of
> the patch attached to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342292;msg=136
>
> It introduces limits.h and does the same we did for the xpdf patches at
> the beginning of the year, namely change code that can be optimized away
> by compilers.
... or cause an undefined integer overflow.
> It seems to me that Martin Pitt's patch also has everything that yours
> (Joey's) has
As far as I can see, yes.
> Am I correct that the other issues that Florian found are not addressed
> by any patch yet, and have not yet been widely published? Should I
> delay an upload to sid until this can be fixed, too?
Hm, I'm not aware of any additional issues. Florian raised and
explained why 'p = f1*f2; if (p/f1 != f2)' is flawed, so I updated the
patch to not use it any more. Are there any additional issues I
missed?
Thanks,
Martin
--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntulinux.org
Debian Developer http://www.debian.org
Reply to: