From a11549a566ceed28bc9f6ba100b0d3f6ae59a1f4 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Sat, 21 Feb 2015 18:22:32 -0500 Subject: Detect loops in /Pages structure Pushing inherited objects to pages and getting all pages were both prone to stack overflow infinite loops if there were loops in the Pages dictionary. There is a general weakness in the code in that any part of the code that traverses the Pages structure would be prone to this and would have to implement its own loop detection. A more robust fix may provide some general method for handling the Pages structure, but it's probably not worth doing. Note: addition of *Internal2 private functions was done rather than changing signatures of existing methods to avoid breaking compatibility. --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index 88def950..798addd4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ 2015-02-21 Jay Berkenbilt + * Detect loops in Pages structure. Thanks to Gynvael Coldwind and + Mateusz Jurczyk of the Google Security Team for providing a sample + file with this problem. + * Prevent buffer overrun when converting a password to an encryption key. Thanks to Gynvael Coldwind and Mateusz Jurczyk of the Google Security Team for providing a sample file with this -- cgit v1.2.3-70-g09d2