106 lines
3.6 KiB
Diff
106 lines
3.6 KiB
Diff
diff -pur libwmf-0.2.8.4/src/extra/gd/gd.c libwmf-0.2.8.4-fix/src/extra/gd/gd.c
|
|
--- libwmf-0.2.8.4/src/extra/gd/gd.c 2005-07-27 22:35:05.000000000 +0200
|
|
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd.c 2006-06-30 09:23:28.000000000 +0200
|
|
@@ -1866,6 +1866,12 @@ gdImageCopyResized (gdImagePtr dst, gdIm
|
|
int *sty;
|
|
/* We only need to use floating point to determine the correct
|
|
stretch vector for one line's worth. */
|
|
+ if (overflow2(sizeof (int), srcW)) {
|
|
+ return;
|
|
+ }
|
|
+ if (overflow2(sizeof (int), srcH)) {
|
|
+ return;
|
|
+ }
|
|
double accum;
|
|
stx = (int *) gdMalloc (sizeof (int) * srcW);
|
|
sty = (int *) gdMalloc (sizeof (int) * srcH);
|
|
@@ -2275,6 +2281,9 @@ gdImageFilledPolygon (gdImagePtr im, gdP
|
|
}
|
|
if (!im->polyAllocated)
|
|
{
|
|
+ if (overflow2(sizeof (int), n)) {
|
|
+ return;
|
|
+ }
|
|
im->polyInts = (int *) gdMalloc (sizeof (int) * n);
|
|
im->polyAllocated = n;
|
|
}
|
|
@@ -2369,6 +2378,9 @@ gdImageSetStyle (gdImagePtr im, int *sty
|
|
{
|
|
gdFree (im->style);
|
|
}
|
|
+ if (overflow2(sizeof (int), noOfPixels)) {
|
|
+ return;
|
|
+ }
|
|
im->style = (int *)
|
|
gdMalloc (sizeof (int) * noOfPixels);
|
|
memcpy (im->style, style, sizeof (int) * noOfPixels);
|
|
diff -pur libwmf-0.2.8.4/src/extra/gd/gd_io_dp.c libwmf-0.2.8.4-fix/src/extra/gd/gd_io_dp.c
|
|
--- libwmf-0.2.8.4/src/extra/gd/gd_io_dp.c 2001-05-19 15:09:34.000000000 +0200
|
|
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd_io_dp.c 2006-06-30 09:21:43.000000000 +0200
|
|
@@ -185,6 +185,9 @@ dynamicSeek (struct gdIOCtx *ctx, const
|
|
bytesNeeded = pos;
|
|
if (bytesNeeded > dp->realSize)
|
|
{
|
|
+ if (overflow2(dp->realSize, 2)) {
|
|
+ return FALSE;
|
|
+ }
|
|
if (!gdReallocDynamic (dp, dp->realSize * 2))
|
|
{
|
|
dp->dataGood = FALSE;
|
|
@@ -356,6 +359,9 @@ appendDynamic (dynamicPtr * dp, const vo
|
|
|
|
if (bytesNeeded > dp->realSize)
|
|
{
|
|
+ if (overflow2(dp->realSize, 2)) {
|
|
+ return FALSE;
|
|
+ }
|
|
if (!gdReallocDynamic (dp, bytesNeeded * 2))
|
|
{
|
|
dp->dataGood = FALSE;
|
|
Only in libwmf-0.2.8.4/src/extra/gd: gd_security.c.CAN-2004-0990
|
|
diff -pur libwmf-0.2.8.4/src/extra/gd/gd_topal.c libwmf-0.2.8.4-fix/src/extra/gd/gd_topal.c
|
|
--- libwmf-0.2.8.4/src/extra/gd/gd_topal.c 2005-07-27 22:35:06.000000000 +0200
|
|
+++ libwmf-0.2.8.4-fix/src/extra/gd/gd_topal.c 2006-06-30 09:19:29.000000000 +0200
|
|
@@ -670,6 +670,9 @@ select_colors (gdImagePtr im, my_cquanti
|
|
int i;
|
|
|
|
/* Allocate workspace for box list */
|
|
+ if (overflow2(desired_colors, sizeof (box))) {
|
|
+ return;
|
|
+ }
|
|
boxlist = (boxptr) gdMalloc (desired_colors * sizeof (box));
|
|
/* Initialize one box containing whole space */
|
|
numboxes = 1;
|
|
diff -pur libwmf-0.2.8.4/src/extra/gd/wbmp.c libwmf-0.2.8.4-fix/src/extra/gd/wbmp.c
|
|
--- libwmf-0.2.8.4/src/extra/gd/wbmp.c 2005-07-27 22:35:06.000000000 +0200
|
|
+++ libwmf-0.2.8.4-fix/src/extra/gd/wbmp.c 2006-06-30 09:18:53.000000000 +0200
|
|
@@ -116,6 +116,14 @@ createwbmp (int width, int height, int c
|
|
if ((wbmp = (Wbmp *) gdMalloc (sizeof (Wbmp))) == NULL)
|
|
return (NULL);
|
|
|
|
+ if (overflow2(sizeof (int), width)) {
|
|
+ gdFree(wbmp);
|
|
+ return (NULL);
|
|
+ }
|
|
+ if (overflow2(sizeof (int) * width, height)) {
|
|
+ gdFree(wbmp);
|
|
+ return (NULL);
|
|
+ }
|
|
if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * width * height)) == NULL)
|
|
{
|
|
gdFree (wbmp);
|
|
@@ -176,6 +184,13 @@ readwbmp (int (*getin) (void *in), void
|
|
printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
|
|
#endif
|
|
|
|
+ if (overflow2(sizeof (int), wbmp->width) ||
|
|
+ overflow2(sizeof (int) * wbmp->width, wbmp->height))
|
|
+ {
|
|
+ gdFree(wbmp);
|
|
+ return (-1);
|
|
+ }
|
|
+
|
|
if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)
|
|
{
|
|
gdFree (wbmp);
|