A flaw was found in GNU patch before 2.7.6. An Out-of-bounds access within pchwriteline() function in pch.c file which can lead to a Denial of Service via a crafted input file.
External References:
https://savannah.gnu.org/bugs/index.php?45990
Upstream Patch:
https://git.savannah.gnu.org/cgit/patch.git/commit/src/pch.c?id=a0d7fe4589651c6
GNU patch through version 2.7.6 is vulnerable to a double freeing of memory when supplied a crafted patch file leading to a crash.
Upstream Issue:
https://savannah.gnu.org/bugs/index.php?53133
It was reported [1] that a crafted diff file (attached) can make patch to eat memory and later segfault. Upstream commit that fixes this: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=0c08d7a902c6fdd49b704623a12d8d672ef18944
[1]: https://savannah.gnu.org/bugs/?44051