Bug 251102 - textproc/raptor2: another crash report from fuzzing
Summary: textproc/raptor2: another crash report from fuzzing
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-kde (Team)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-13 13:56 UTC by Kurt Jaeger
Modified: 2021-02-20 16:41 UTC (History)
3 users (show)

See Also:
tcberner: maintainer-feedback+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Tobias C. Berner freebsd_committer 2020-11-13 14:58:45 UTC 
Moin moin 

That should already be adressed; See r554670 and r554671 


mfg Tobias
Comment 2 Kurt Jaeger freebsd_committer 2020-11-13 15:32:51 UTC 
If I read the golem article, the CVE covers another bug, which is indeed fixed by the two revisions. Hanno links a new bug which has no CVE and no fix as of now.
Comment 3 Kurt Jaeger freebsd_committer 2020-11-13 15:33:28 UTC 
(In reply to Kurt Jaeger from comment #2)
The link is at the very end of the article, bug 650
Comment 4 commit-hook freebsd_committer 2021-02-20 16:24:02 UTC 
A commit references this bug:

Author: adridg
Date: Sat Feb 20 16:23:20 UTC 2021
New revision: 566164
URL: https://svnweb.freebsd.org/changeset/ports/566164

Log:
  Add fix for CVE-2020-25713 raptor2: malformed input file segfault

  The sample file in the upstream bug report from the PR causes a
  bus error in PORTREVISION 16, and returns an error (as I suppose
  it should) now.

  PR:		251102
  Reported by:	pi
  Obtained from:	upstream

Changes:
  head/textproc/raptor2/Makefile
  head/textproc/raptor2/files/patch-CVE-2020-25713
Comment 5 commit-hook freebsd_committer 2021-02-20 16:38:09 UTC 
A commit references this bug:

Author: adridg
Date: Sat Feb 20 16:38:05 UTC 2021
New revision: 566165
URL: https://svnweb.freebsd.org/changeset/ports/566165

Log:
  Add vuxml entry for textproc/raptor2 CVE

  PR:		251102

Changes:
  head/security/vuxml/vuln.xml
Comment 6 Adriaan de Groot freebsd_committer 2021-02-20 16:41:58 UTC 
Thanks for reporting; it was indeed one *more* bug (which bus errors for me, rather than segfaulting, but still not good).