From c407c458d36e6d945e0143094501854c61d7cec4 Mon Sep 17 00:00:00 2001 From: Rex Dieter Date: Mon, 25 Aug 2014 13:50:16 -0500 Subject: [PATCH] better fix for CVE-2014-1947 (#1064098,#1083082) --- GraphicsMagick-1.3.20-CVE-2014-1947.patch | 4 ++-- GraphicsMagick.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/GraphicsMagick-1.3.20-CVE-2014-1947.patch b/GraphicsMagick-1.3.20-CVE-2014-1947.patch index 27b16cd..8484b31 100644 --- a/GraphicsMagick-1.3.20-CVE-2014-1947.patch +++ b/GraphicsMagick-1.3.20-CVE-2014-1947.patch @@ -17,8 +17,8 @@ diff -up GraphicsMagick-1.3.20/coders/psd.c.CVE-2014-1947 GraphicsMagick-1.3.20/ } else { - (void) sprintf((char *) layer_name, "L%02d", layer_count++ ); - WritePascalString( image, (char*)layer_name, 4 ); -+ char layer_name[4]; -+ (void) sprintf(layer_name, "L%02d", layer_count++ ); ++ char layer_name[MaxTextExtent]; ++ (void) sprintf(layer_name, "L%06ld", layer_count++ ); + WritePascalString( image, layer_name, 4 ); } tmp_image = tmp_image->next; diff --git a/GraphicsMagick.spec b/GraphicsMagick.spec index f6d229a..15a8cce 100644 --- a/GraphicsMagick.spec +++ b/GraphicsMagick.spec @@ -33,7 +33,7 @@ Summary: An ImageMagick fork, offering faster image generation and better quality Name: GraphicsMagick Version: 1.3.20 -Release: 1%{?dist} +Release: 2%{?dist} License: MIT Group: Applications/Multimedia @@ -313,6 +313,9 @@ rm -rf %{buildroot} %changelog +* Mon Aug 25 2014 Rex Dieter 1.3.20-2 +- better fix for CVE-2014-1947 (#1064098,#1083082) + * Wed Aug 20 2014 Rex Dieter 1.3.20-1 - 1.3.20, CVE-2014-1947 (#1064098,#1083082)