已开启
Fix CVE-2022-23584 #134
XingSongSun创建于 6月2日
Fix CVE-2022-23584 #134
已开启
共 2 个文件变更+31-2
| @@ -0,0 +1,25 @@ | |||
| 1 | +From e746adbfcfee15e9cfdb391ff746c765b99bdf9b Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Mihai Maruseac <mihaimaruseac@google.com> | ||
| 3 | +Date: Thu, 11 Nov 2021 19:12:19 -0800 | ||
| 4 | +Subject: [PATCH] Prevent use after free in `DecodePng` kernel. | ||
| 5 | + | ||
| 6 | +We are cleaning up the memory in `decode` and then we are using an `OP_REQUIRES` to check an invariant on the `decode` data. | ||
| 7 | + | ||
| 8 | +PiperOrigin-RevId: 409299145 | ||
| 9 | +Change-Id: I4eb93aaca52483eb202e89b78df07fbb2f6cb254 | ||
| 10 | +--- | ||
| 11 | + tensorflow/core/kernels/image/decode_image_op.cc | 1 - | ||
| 12 | + 1 file changed, 1 deletion(-) | ||
| 13 | + | ||
| 14 | +diff --git a/tensorflow/core/kernels/image/decode_image_op.cc b/tensorflow/core/kernels/image/decode_image_op.cc | ||
| 15 | +index 4573b4db0f46ca..a0345b7e0b79b0 100644 | ||
| 16 | +--- a/tensorflow/core/kernels/image/decode_image_op.cc | ||
| 17 | ++++ b/tensorflow/core/kernels/image/decode_image_op.cc | ||
| 18 | + class DecodeImageV2Op : public OpKernel { | ||
| 19 | + if (width != static_cast<int64_t>(decode.width) || width <= 0 || | ||
| 20 | + width >= (1LL << 27) || height != static_cast<int64_t>(decode.height) || | ||
| 21 | + height <= 0 || height >= (1LL << 27) || total_size >= (1LL << 29)) { | ||
| 22 | +- png::CommonFreeDecode(&decode); | ||
| 23 | + OP_REQUIRES(context, false, | ||
| 24 | + errors::InvalidArgument("PNG size too large for int: ", | ||
| 25 | + decode.width, " by ", decode.height)); | ||
| @@ -1,7 +1,7 @@ | |||
| 1 | %global _empty_manifest_terminate_build 0 | 1 | %global _empty_manifest_terminate_build 0 |
| 2 | Name: tensorflow | 2 | Name: tensorflow |
| 3 | Version: 2.12.1 | 3 | Version: 2.12.1 |
| 4 | -Release: 5 | 4 | +Release: 6 |
| 5 | Summary: An Open Source Machine Learning Framework for Everyone | 5 | Summary: An Open Source Machine Learning Framework for Everyone |
| 6 | License: Apache License 2.0 | 6 | License: Apache License 2.0 |
| 7 | URL: https://www.tensorflow.org/ | 7 | URL: https://www.tensorflow.org/ |
| @@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch | |||
| 17 | %endif | 17 | %endif |
| 18 | %ifarch riscv64 | 18 | %ifarch riscv64 |
| 19 | Patch1100: riscv64_external_files.patch | 19 | Patch1100: riscv64_external_files.patch |
| 20 | +Patch1101: backport-CVE-2022-23584.patch | ||
| 20 | %endif | 21 | %endif |
| 21 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum | 22 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum |
| 22 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py | 23 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py |
| @@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa | |||
| 45 | 46 | ||
| 46 | %prep | 47 | %prep |
| 47 | %setup -n %{name}-%{version} | 48 | %setup -n %{name}-%{version} |
| 49 | +%patch -P 1101 -p1 | ||
| 48 | %patch 0 -p1 | 50 | %patch 0 -p1 |
| 49 | %patch 1 -p1 | 51 | %patch 1 -p1 |
| 50 | %patch 2 -p1 | 52 | %patch 2 -p1 |
| @@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 84 | %{_bindir}/* | 86 | %{_bindir}/* |
| 85 | 87 | ||
| 86 | %changelog | 88 | %changelog |
| 89 | +* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6 | ||
| 90 | +- Fix CVE-2022-23584 | ||
| 87 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 | 91 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 |
| 88 | - fix CVE-2026-2492 | 92 | - fix CVE-2026-2492 |
| 89 | 93 | ||
| @@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 122 | - fix some cves | 126 | - fix some cves |
| 123 | 127 | ||
| 124 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 | 128 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 |
| 125 | -- Package init | 129 | +- Package init |