blob: 110f6b1ab88625ea854f86c4ec66995a6e966be7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
From 10320184df1eb4638e253a34b1eb44ce78954094 Mon Sep 17 00:00:00 2001
From: Gabi Melman <gmelman1@gmail.com>
Date: Mon, 17 Mar 2025 15:46:31 +0200
Subject: [PATCH] Fixed issue #3360 (#3361)
Backport of upstream commit 10320184df1eb4638e253a34b1eb44ce78954094 for
spdlog 1.11.0 (CVE-2025-6140, allocation-size-too-big in scoped_padder).
Only the scoped_padder fix is kept. The unrelated field_size change
(D_formatter) and whitespace cleanup from the original upstream commit
are intentionally dropped, since they are not part of this CVE's fix and
would alter unrelated behavior.
---
include/spdlog/pattern_formatter-inl.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/spdlog/pattern_formatter-inl.h b/include/spdlog/pattern_formatter-inl.h
--- a/include/spdlog/pattern_formatter-inl.h
+++ b/include/spdlog/pattern_formatter-inl.h
@@ -76,6 +76,10 @@
else if (padinfo_.truncate_)
{
long new_size = static_cast<long>(dest_.size()) + remaining_pad_;
+ if (new_size < 0)
+ {
+ new_size = 0;
+ }
dest_.resize(static_cast<size_t>(new_size));
}
}
|
