From 2810189d0b33f8d8c5c2d9a78ff9664b65fc6c6e Mon Sep 17 00:00:00 2001 From: CoprDistGit Date: Fri, 16 Oct 2026 04:02:10 +0000 Subject: automatic import of spdlog --- CVE-2025-6140.patch | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 CVE-2025-6140.patch (limited to 'CVE-2025-6140.patch') diff --git a/CVE-2025-6140.patch b/CVE-2025-6140.patch new file mode 100644 index 0000000..110f6b1 --- /dev/null +++ b/CVE-2025-6140.patch @@ -0,0 +1,31 @@ +From 10320184df1eb4638e253a34b1eb44ce78954094 Mon Sep 17 00:00:00 2001 +From: Gabi Melman +Date: Mon, 17 Mar 2025 15:46:31 +0200 +Subject: [PATCH] Fixed issue #3360 (#3361) + +Backport of upstream commit 10320184df1eb4638e253a34b1eb44ce78954094 for +spdlog 1.11.0 (CVE-2025-6140, allocation-size-too-big in scoped_padder). + +Only the scoped_padder fix is kept. The unrelated field_size change +(D_formatter) and whitespace cleanup from the original upstream commit +are intentionally dropped, since they are not part of this CVE's fix and +would alter unrelated behavior. + +--- + include/spdlog/pattern_formatter-inl.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/spdlog/pattern_formatter-inl.h b/include/spdlog/pattern_formatter-inl.h +--- a/include/spdlog/pattern_formatter-inl.h ++++ b/include/spdlog/pattern_formatter-inl.h +@@ -76,6 +76,10 @@ + else if (padinfo_.truncate_) + { + long new_size = static_cast(dest_.size()) + remaining_pad_; ++ if (new_size < 0) ++ { ++ new_size = 0; ++ } + dest_.resize(static_cast(new_size)); + } + } -- cgit v1.2.3