bzip2: Add a patch for checking nselector's upperbound
In bzip2 decompressor, the upper bound of nselectors have not been
checked and hence a bad payload can cause a segfault. This patch adds
that required upperbound check.
BUG=b:136070099
TEST=tryjob
RELEASE_NOTE=Fixed vulnerability in app-arch/bzip2 (CVE-2019-12900)
Change-Id: I0891eddd2931137b7392f11bde44792616cf6c55
Reviewed-on: https://chromium-review.googlesource.com/1537169
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Amin Hassani <ahassani@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Nicolas Norvez <norvez@chromium.org>
(cherry picked from commit 3dfb468ccf53c76042396e84c1a5abbeb4046f7c)
Signed-off-by: vaibhavrustagi <vaibhavrustagi@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/overlays/portage-stable/+/1679370
2 files changed
