diff -Nru librecad-2.1.3/debian/changelog librecad-2.1.3/debian/changelog --- librecad-2.1.3/debian/changelog 2022-01-18 12:05:14.000000000 +0000 +++ librecad-2.1.3/debian/changelog 2022-01-30 12:47:48.000000000 +0000 @@ -1,3 +1,10 @@ +librecad (2.1.3-3) unstable; urgency=medium + + * Team upload. + * Add patches for CVE-2021-45341, CVE-2021-45342, CVE-2021-45343 + + -- Aron Xu Sun, 30 Jan 2022 20:47:48 +0800 + librecad (2.1.3-2) unstable; urgency=medium * Team upload. @@ -13,7 +20,7 @@ specially-crafted .dxf file can lead to a use-after-free vulnerability. - -- Aron Xu Tue, 18 Jan 2022 12:05:14 +0000 + -- Aron Xu Sun, 30 Jan 2022 18:44:04 +0800 librecad (2.1.3-1.3) unstable; urgency=medium diff -Nru librecad-2.1.3/debian/patches/CVE-2021-45341.patch librecad-2.1.3/debian/patches/CVE-2021-45341.patch --- librecad-2.1.3/debian/patches/CVE-2021-45341.patch 1970-01-01 00:00:00.000000000 +0000 +++ librecad-2.1.3/debian/patches/CVE-2021-45341.patch 2022-01-30 12:46:54.000000000 +0000 @@ -0,0 +1,53 @@ +From f3502963eaf379a429bc9da73c1224c5db649997 Mon Sep 17 00:00:00 2001 +From: eldstal +Date: Sat, 18 Dec 2021 20:27:34 +0100 +Subject: [PATCH 03/14] Added bounds checking to CDataMoji in jww parser. + +This fixes issue #1462 +--- + libraries/jwwlib/src/jwwdoc.h | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/libraries/jwwlib/src/jwwdoc.h b/libraries/jwwlib/src/jwwdoc.h +index fc8cd217..a11bc63a 100644 +--- a/libraries/jwwlib/src/jwwdoc.h ++++ b/libraries/jwwlib/src/jwwdoc.h +@@ -521,7 +521,17 @@ cout << "MojiData1:" << m_strFontName << endl; + }else + { + ifstr >> wd; ++ ++ DWORD skip = 0; ++ if (wd > 511) { ++ skip = wd - 511; ++ wd = 511; ++ } ++ + ifstr.read(buf,wd); ++ ++ if (skip != 0) ifstr.ignore(skip); ++ + buf[wd] = '\0'; + m_strFontName = buf; + #ifdef DATA_DUMP +@@ -539,7 +549,17 @@ cout << "MojiData3:" << m_string << endl; + }else + { + ifstr >> wd; ++ ++ DWORD skip = 0; ++ if (wd > 511) { ++ skip = wd - 511; ++ wd = 511; ++ } ++ + ifstr.read(buf,wd); ++ ++ if (skip != 0) ifstr.ignore(skip); ++ + buf[wd] = '\0'; + m_string = buf; + #ifdef DATA_DUMP +-- +2.30.2 + diff -Nru librecad-2.1.3/debian/patches/CVE-2021-45342.patch librecad-2.1.3/debian/patches/CVE-2021-45342.patch --- librecad-2.1.3/debian/patches/CVE-2021-45342.patch 1970-01-01 00:00:00.000000000 +0000 +++ librecad-2.1.3/debian/patches/CVE-2021-45342.patch 2022-01-30 12:47:00.000000000 +0000 @@ -0,0 +1,35 @@ +From 4edcbe72679f95cb60979c77a348c1522a20b0f4 Mon Sep 17 00:00:00 2001 +From: eldstal +Date: Sat, 18 Dec 2021 23:55:22 +0100 +Subject: [PATCH 04/14] Added bounds check to CDataList in JWW parser + +This fixes issue #1464 +--- + libraries/jwwlib/src/jwwdoc.h | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/libraries/jwwlib/src/jwwdoc.h b/libraries/jwwlib/src/jwwdoc.h +index fc8cd217..7ccf2d83 100644 +--- a/libraries/jwwlib/src/jwwdoc.h ++++ b/libraries/jwwlib/src/jwwdoc.h +@@ -793,7 +793,17 @@ cout << "MojiData1:" << m_strName << endl; + }else + { + ifstr >> wd; ++ ++ DWORD skip = 0; ++ if (wd > 511) { ++ skip = wd - 511; ++ wd = 511; ++ } ++ + ifstr.read(buf,wd); ++ ++ if (skip != 0) ifstr.ignore(skip); ++ + buf[wd] = '\0'; + m_strName = buf; + #ifdef DATA_DUMP +-- +2.30.2 + diff -Nru librecad-2.1.3/debian/patches/CVE-2021-45343.patch librecad-2.1.3/debian/patches/CVE-2021-45343.patch --- librecad-2.1.3/debian/patches/CVE-2021-45343.patch 1970-01-01 00:00:00.000000000 +0000 +++ librecad-2.1.3/debian/patches/CVE-2021-45343.patch 2022-01-30 10:43:16.000000000 +0000 @@ -0,0 +1,26 @@ +From 5771425808bd16e78e1c6f28728c0712c47316f7 Mon Sep 17 00:00:00 2001 +From: eldstal +Date: Sun, 19 Dec 2021 17:57:07 +0100 +Subject: [PATCH 05/14] Added NULL check for hatch code 93 + +This fixes issue #1468 +--- + libraries/libdxfrw/src/drw_entities.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libraries/libdxfrw/src/drw_entities.cpp b/libraries/libdxfrw/src/drw_entities.cpp +index b4f6cd02..9c9d9b77 100644 +--- a/libraries/libdxfrw/src/drw_entities.cpp ++++ b/libraries/libdxfrw/src/drw_entities.cpp +@@ -1805,7 +1805,7 @@ void DRW_Hatch::parseCode(int code, dxfReader *reader){ + break; + case 93: + if (pline) pline->vertexnum = reader->getInt32(); +- else loop->numedges = reader->getInt32();//aqui reserve ++ else if (loop) loop->numedges = reader->getInt32();//aqui reserve + break; + case 98: //seed points ?? + clearEntities(); +-- +2.30.2 + diff -Nru librecad-2.1.3/debian/patches/series librecad-2.1.3/debian/patches/series --- librecad-2.1.3/debian/patches/series 2022-01-18 12:05:14.000000000 +0000 +++ librecad-2.1.3/debian/patches/series 2022-01-30 10:43:41.000000000 +0000 @@ -6,3 +6,6 @@ CVE-2021-21898.patch CVE-2021-21899.patch CVE-2021-21900.patch +CVE-2021-45341.patch +CVE-2021-45342.patch +CVE-2021-45343.patch