diff options
Diffstat (limited to 'media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch')
| -rw-r--r-- | media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch | 74 |
1 files changed, 74 insertions, 0 deletions
diff --git a/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch b/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch new file mode 100644 index 000000000000..7bda5b065c0a --- /dev/null +++ b/media-libs/gegl/files/gegl-0.1.8-cve-2012-4433-4757cdf7.patch @@ -0,0 +1,74 @@ +From 3d3b1559cb34bc862f145c9880d156f6f2fe7b5f Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Sat, 17 Nov 2012 16:22:21 +0100 +Subject: [PATCH] ppm-load: CVE-2012-4433: add plausibility checks for header + fields + +"Port" of 4757cdf73d3675478d645a3ec8250ba02168a230 by Nils Philippsen from GEGL 0.2.0 to 0.1.8 +--- + operations/external/ppm-load.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c +index 6db6e5a..2d4f0ca 100644 +--- a/operations/external/ppm-load.c ++++ b/operations/external/ppm-load.c +@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load.")) + #include "gegl-chant.h" + #include <stdio.h> + #include <stdlib.h> ++#include <errno.h> + + typedef enum { + PIXMAP_ASCII = 51, +@@ -44,8 +45,8 @@ typedef enum { + + typedef struct { + map_type type; +- gint width; +- gint height; ++ glong width; ++ glong height; + gsize numsamples; /* width * height * channels */ + gsize bpc; /* bytes per channel */ + guchar *data; +@@ -82,11 +83,33 @@ ppm_load_read_header(FILE *fp, + } + + /* Get Width and Height */ +- img->width = strtol (header,&ptr,0); +- img->height = atoi (ptr); ++ errno = 0; ++ img->width = strtol (header,&ptr,10); ++ if (errno) ++ { ++ g_warning ("Error reading width: %s", strerror(errno)); ++ return FALSE; ++ } ++ else if (img->width < 0) ++ { ++ g_warning ("Error: width is negative"); ++ return FALSE; ++ } ++ ++ img->height = strtol (ptr,&ptr,10); ++ if (errno) ++ { ++ g_warning ("Error reading height: %s", strerror(errno)); ++ return FALSE; ++ } ++ else if (img->width < 0) ++ { ++ g_warning ("Error: height is negative"); ++ return FALSE; ++ } + + retval = fgets (header,MAX_CHARS_IN_ROW,fp); +- maxval = strtol (header,&ptr,0); ++ maxval = strtol (header,&ptr,10); + + if ((maxval != 255) && (maxval != 65535)) + { +-- +1.7.12.4 + |