diff options
| author | Petr Štetiar <ynezz@true.cz> | 2022-03-24 06:45:04 +0100 |
|---|---|---|
| committer | Petr Štetiar <ynezz@true.cz> | 2022-03-24 10:02:01 +0100 |
| commit | 0af411f49d43cb6e6cb00773abe63504392fb873 (patch) | |
| tree | 6aef6362eeed556a7c8b49b6f5209efddfbf4726 /target/linux/generic/hack-4.14 | |
| parent | 565159db573a68d5dbc2a73231dd999b5d45781b (diff) | |
| download | upstream-0af411f49d43cb6e6cb00773abe63504392fb873.tar.gz upstream-0af411f49d43cb6e6cb00773abe63504392fb873.tar.bz2 upstream-0af411f49d43cb6e6cb00773abe63504392fb873.zip | |
zlib: backport security fix for a reproducible crash in compressor
Tavis has just reported, that he was recently trying to track down a
reproducible crash in a compressor. Believe it or not, it really was a
bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.
Tavis has reported it upstream, but it turns out the issue has been
public since 2018, but the patch never made it into a release. As far as
he knows, nobody ever assigned it a CVE.
Runtime tested on ipq40xx/glinet-b1300 and mvebu/turris-omnia.
Suggested-by: Tavis Ormandy <taviso@gmail.com>
References: https://www.openwall.com/lists/oss-security/2022/03/24/1
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit b3aa2909a79aeff20d594160b207a89dc807c033)
(cherry picked from commit 3965dda0fa70dc9408f1a2e55a3ddefde78bd50e)
(cherry picked from commit f65edc9b990c2bcc10c9e9fca29253adc6fe316d)
Diffstat (limited to 'target/linux/generic/hack-4.14')
0 files changed, 0 insertions, 0 deletions