829835 – (CVE-2021-45261) sys-devel/patch: invalid free vulnerability

Bug 829835 (CVE-2021-45261) - sys-devel/patch: invalid free vulnerability

Summary: sys-devel/patch: invalid free vulnerability

Status:	CONFIRMED

Alias:	CVE-2021-45261

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo Security

URL:	https://savannah.gnu.org/bugs/?61685
Whiteboard:	A3 [upstream]
Keywords:

Depends on:
Blocks:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-12-22 20:09:12 UTC

CVE-2021-45261:

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

Comment 1 Sam James archtester

2022-08-17 00:18:44 UTC

Possibly fixed by https://git.savannah.gnu.org/cgit/patch.git/commit/?id=15b158db3ae11cb835f2eb8d2eb48e09d1a4af48.

Comment 2 John Helmert III archtester

2022-08-17 17:28:27 UTC

Still triggers an ASAN crash for me