Control: tags 1023427 + patch Control: tags 1023427 + pending
Dear maintainer, I've prepared an NMU for pixman (versioned as 0.40.0-1.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards, Salvatore
diff -u pixman-0.40.0/debian/changelog pixman-0.40.0/debian/changelog --- pixman-0.40.0/debian/changelog +++ pixman-0.40.0/debian/changelog @@ -1,3 +1,11 @@ +pixman (0.40.0-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * Avoid integer overflow leading to out-of-bounds write (CVE-2022-44638) + (Closes: #1023427) + + -- Salvatore Bonaccorso <car...@debian.org> Thu, 03 Nov 2022 23:07:46 +0100 + pixman (0.40.0-1) unstable; urgency=medium * New upstream release. (Closes: #958298, #832579, #838650) diff -u pixman-0.40.0/debian/patches/series pixman-0.40.0/debian/patches/series --- pixman-0.40.0/debian/patches/series +++ pixman-0.40.0/debian/patches/series @@ -1 +1,2 @@ test-increase-timeout.diff +Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff only in patch2: unchanged: --- pixman-0.40.0.orig/debian/patches/Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff +++ pixman-0.40.0/debian/patches/Avoid-integer-overflow-leading-to-out-of-bounds-writ.diff @@ -0,0 +1,32 @@ +From: Matt Turner <matts...@gmail.com> +Date: Wed, 2 Nov 2022 12:07:32 -0400 +Subject: Avoid integer overflow leading to out-of-bounds write +Origin: https://gitlab.freedesktop.org/pixman/pixman/-/commit/a1f88e842e0216a5b4df1ab023caebe33c101395 +Bug: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 +Bug-Debian: https://bugs.debian.org/1023427 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-44638 + +Thanks to Maddie Stone and Google's Project Zero for discovering this +issue, providing a proof-of-concept, and a great analysis. + +Closes: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 +--- + pixman/pixman-trap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pixman/pixman-trap.c b/pixman/pixman-trap.c +index 91766fdbfca0..7560405ee2e4 100644 +--- a/pixman/pixman-trap.c ++++ b/pixman/pixman-trap.c +@@ -74,7 +74,7 @@ pixman_sample_floor_y (pixman_fixed_t y, + + if (f < Y_FRAC_FIRST (n)) + { +- if (pixman_fixed_to_int (i) == 0x8000) ++ if (pixman_fixed_to_int (i) == 0xffff8000) + { + f = 0; /* saturate */ + } +-- +2.37.2 +
