libwmf/libwmf-0.2.8.4-CAN-2004-0941.patch

106 lines
3.6 KiB
Diff

diff -pur libwmf-0.2.8.4/src/extra/gd/gd.c libwmf-0.2.8.4-fix/src/extra/gd/gd.c
--- libwmf-0.2.8.4/src/extra/gd/gd.c 2005-07-27 22:35:05.000000000 +0200
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd.c 2006-06-30 09:23:28.000000000 +0200
@@ -1866,6 +1866,12 @@ gdImageCopyResized (gdImagePtr dst, gdIm
int *sty;
/* We only need to use floating point to determine the correct
stretch vector for one line's worth. */
+ if (overflow2(sizeof (int), srcW)) {
+ return;
+ }
+ if (overflow2(sizeof (int), srcH)) {
+ return;
+ }
double accum;
stx = (int *) gdMalloc (sizeof (int) * srcW);
sty = (int *) gdMalloc (sizeof (int) * srcH);
@@ -2275,6 +2281,9 @@ gdImageFilledPolygon (gdImagePtr im, gdP
}
if (!im->polyAllocated)
{
+ if (overflow2(sizeof (int), n)) {
+ return;
+ }
im->polyInts = (int *) gdMalloc (sizeof (int) * n);
im->polyAllocated = n;
}
@@ -2369,6 +2378,9 @@ gdImageSetStyle (gdImagePtr im, int *sty
{
gdFree (im->style);
}
+ if (overflow2(sizeof (int), noOfPixels)) {
+ return;
+ }
im->style = (int *)
gdMalloc (sizeof (int) * noOfPixels);
memcpy (im->style, style, sizeof (int) * noOfPixels);
diff -pur libwmf-0.2.8.4/src/extra/gd/gd_io_dp.c libwmf-0.2.8.4-fix/src/extra/gd/gd_io_dp.c
--- libwmf-0.2.8.4/src/extra/gd/gd_io_dp.c 2001-05-19 15:09:34.000000000 +0200
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd_io_dp.c 2006-06-30 09:21:43.000000000 +0200
@@ -185,6 +185,9 @@ dynamicSeek (struct gdIOCtx *ctx, const
bytesNeeded = pos;
if (bytesNeeded > dp->realSize)
{
+ if (overflow2(dp->realSize, 2)) {
+ return FALSE;
+ }
if (!gdReallocDynamic (dp, dp->realSize * 2))
{
dp->dataGood = FALSE;
@@ -356,6 +359,9 @@ appendDynamic (dynamicPtr * dp, const vo
if (bytesNeeded > dp->realSize)
{
+ if (overflow2(dp->realSize, 2)) {
+ return FALSE;
+ }
if (!gdReallocDynamic (dp, bytesNeeded * 2))
{
dp->dataGood = FALSE;
Only in libwmf-0.2.8.4/src/extra/gd: gd_security.c.CAN-2004-0990
diff -pur libwmf-0.2.8.4/src/extra/gd/gd_topal.c libwmf-0.2.8.4-fix/src/extra/gd/gd_topal.c
--- libwmf-0.2.8.4/src/extra/gd/gd_topal.c 2005-07-27 22:35:06.000000000 +0200
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd_topal.c 2006-06-30 09:19:29.000000000 +0200
@@ -670,6 +670,9 @@ select_colors (gdImagePtr im, my_cquanti
int i;
/* Allocate workspace for box list */
+ if (overflow2(desired_colors, sizeof (box))) {
+ return;
+ }
boxlist = (boxptr) gdMalloc (desired_colors * sizeof (box));
/* Initialize one box containing whole space */
numboxes = 1;
diff -pur libwmf-0.2.8.4/src/extra/gd/wbmp.c libwmf-0.2.8.4-fix/src/extra/gd/wbmp.c
--- libwmf-0.2.8.4/src/extra/gd/wbmp.c 2005-07-27 22:35:06.000000000 +0200
+++ libwmf-0.2.8.4-fix/src/extra/gd/wbmp.c 2006-06-30 09:18:53.000000000 +0200
@@ -116,6 +116,14 @@ createwbmp (int width, int height, int c
if ((wbmp = (Wbmp *) gdMalloc (sizeof (Wbmp))) == NULL)
return (NULL);
+ if (overflow2(sizeof (int), width)) {
+ gdFree(wbmp);
+ return (NULL);
+ }
+ if (overflow2(sizeof (int) * width, height)) {
+ gdFree(wbmp);
+ return (NULL);
+ }
if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * width * height)) == NULL)
{
gdFree (wbmp);
@@ -176,6 +184,13 @@ readwbmp (int (*getin) (void *in), void
printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
#endif
+ if (overflow2(sizeof (int), wbmp->width) ||
+ overflow2(sizeof (int) * wbmp->width, wbmp->height))
+ {
+ gdFree(wbmp);
+ return (-1);
+ }
+
if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)
{
gdFree (wbmp);