Skip to content

[1.24.x] Backport CVE-2024-46657: Bug 707996: Declare variable fz_var to avoid stale values. - #91

Open
vulgraph wants to merge 1 commit into
ArtifexSoftware:1.24.xfrom
vulgraph:backport/CVE-2024-46657-1.24.x
Open

vulgraph wants to merge 1 commit into
ArtifexSoftware:1.24.xfrom
vulgraph:backport/CVE-2024-46657-1.24.x

Conversation

@vulgraph

Copy link
Copy Markdown

Backport of upstream fix for CVE-2024-46657 to 1.24.x.

  • Upstream commit: b5c898a30f — Bug 707996: Declare variable fz_var to avoid stale values.
  • Cherry-picked with git cherry-pick -x (original author preserved).

Apply was clean against the current tip of the target branch. No code changes on top of the upstream fix.

A fuzzed file provoked an ASAN warning when building release mode.

For good measure, also declare a variable in an unrelated function
in the same tool fz_var.

(cherry picked from commit b5c898a)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants