Compare commits
No commits in common. 'c9' and 'i8c' have entirely different histories.
@ -1 +1 @@
|
|||||||
SOURCES/v0.2.12.tar.gz
|
SOURCES/v0.2.9.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
490a26175ad667fbc0c009d390bf56644919bed6 SOURCES/v0.2.12.tar.gz
|
b63f95da60db128f53ca61c2941f1c07c820d02f SOURCES/v0.2.9.tar.gz
|
||||||
|
|||||||
@ -0,0 +1,148 @@
|
|||||||
|
From f58c813f8afcd08acdd630f378cff1a5009655cc Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
|
||||||
|
Date: Thu, 31 Jan 2019 16:02:19 +0000
|
||||||
|
Subject: [PATCH] merge in fixes for libgd CVE-2019-6978
|
||||||
|
|
||||||
|
---
|
||||||
|
README | 5 +++++
|
||||||
|
configure.ac | 2 +-
|
||||||
|
src/extra/gd/gd_jpeg.c | 21 +++++++++++++++++----
|
||||||
|
src/extra/gd/gd_wbmp.c | 24 ++++++++++++++++++++++--
|
||||||
|
4 files changed, 45 insertions(+), 7 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/extra/gd/gd_jpeg.c b/src/extra/gd/gd_jpeg.c
|
||||||
|
index 7e6dfbb..b270186 100644
|
||||||
|
--- a/src/extra/gd/gd_jpeg.c
|
||||||
|
+++ b/src/extra/gd/gd_jpeg.c
|
||||||
|
@@ -72,6 +72,8 @@ fatal_jpeg_error (j_common_ptr cinfo)
|
||||||
|
exit (99);
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality
|
||||||
|
* QUALITY. If QUALITY is in the range 0-100, increasing values
|
||||||
|
@@ -93,8 +95,12 @@ gdImageJpegPtr (gdImagePtr im, int *size, int quality)
|
||||||
|
{
|
||||||
|
void *rv;
|
||||||
|
gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
|
||||||
|
- gdImageJpegCtx (im, out, quality);
|
||||||
|
- rv = gdDPExtractData (out, size);
|
||||||
|
+ if (out == NULL) return NULL;
|
||||||
|
+ if (!_gdImageJpegCtx(im, out, quality)) {
|
||||||
|
+ rv = gdDPExtractData(out, size);
|
||||||
|
+ } else {
|
||||||
|
+ rv = NULL;
|
||||||
|
+ }
|
||||||
|
out->free (out);
|
||||||
|
return rv;
|
||||||
|
}
|
||||||
|
@@ -103,6 +109,12 @@ static void jpeg_gdIOCtx_dest (j_compress_ptr cinfo, gdIOCtx * outfile);
|
||||||
|
|
||||||
|
void
|
||||||
|
gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
|
||||||
|
+{
|
||||||
|
+ _gdImageJpegCtx(im, outfile, quality);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/* returns 0 on success, 1 on failure */
|
||||||
|
+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
|
||||||
|
{
|
||||||
|
struct jpeg_compress_struct cinfo;
|
||||||
|
struct jpeg_error_mgr jerr;
|
||||||
|
@@ -139,7 +151,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
|
||||||
|
/* we're here courtesy of longjmp */
|
||||||
|
if (row)
|
||||||
|
gdFree (row);
|
||||||
|
- return;
|
||||||
|
+ return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
cinfo.err->error_exit = fatal_jpeg_error;
|
||||||
|
@@ -173,7 +185,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)
|
||||||
|
fprintf (stderr, "gd-jpeg: error: unable to allocate JPEG row "
|
||||||
|
"structure: gdCalloc returns NULL\n");
|
||||||
|
jpeg_destroy_compress (&cinfo);
|
||||||
|
- return;
|
||||||
|
+ return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
rowptr[0] = row;
|
||||||
|
@@ -254,6 +266,7 @@ error:
|
||||||
|
#endif
|
||||||
|
jpeg_destroy_compress (&cinfo);
|
||||||
|
gdFree (row);
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
gdImagePtr
|
||||||
|
diff --git a/src/extra/gd/gd_wbmp.c b/src/extra/gd/gd_wbmp.c
|
||||||
|
index f1258da..4b27043 100644
|
||||||
|
--- a/src/extra/gd/gd_wbmp.c
|
||||||
|
+++ b/src/extra/gd/gd_wbmp.c
|
||||||
|
@@ -85,6 +85,7 @@ gd_getin (void *in)
|
||||||
|
return (gdGetC ((gdIOCtx *) in));
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);
|
||||||
|
|
||||||
|
/* gdImageWBMPCtx
|
||||||
|
** --------------
|
||||||
|
@@ -97,6 +98,12 @@ gd_getin (void *in)
|
||||||
|
*/
|
||||||
|
void
|
||||||
|
gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
|
||||||
|
+{
|
||||||
|
+ _gdImageWBMPCtx(image, fg, out);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/* returns 0 on success, 1 on failure */
|
||||||
|
+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
|
||||||
|
{
|
||||||
|
|
||||||
|
int x, y, pos;
|
||||||
|
@@ -107,7 +114,7 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
|
||||||
|
if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL)
|
||||||
|
{
|
||||||
|
fprintf (stderr, "Could not create WBMP\n");
|
||||||
|
- return;
|
||||||
|
+ return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fill up the WBMP structure */
|
||||||
|
@@ -126,9 +133,16 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
|
||||||
|
|
||||||
|
/* write the WBMP to a gd file descriptor */
|
||||||
|
if (writewbmp (wbmp, &gd_putout, out))
|
||||||
|
+ {
|
||||||
|
fprintf (stderr, "Could not save WBMP\n");
|
||||||
|
+ freewbmp (wbmp);
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* des submitted this bugfix: gdFree the memory. */
|
||||||
|
freewbmp (wbmp);
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@@ -214,8 +228,12 @@ gdImageWBMPPtr (gdImagePtr im, int *size, int fg)
|
||||||
|
{
|
||||||
|
void *rv;
|
||||||
|
gdIOCtx *out = gdNewDynamicCtx (2048, NULL);
|
||||||
|
- gdImageWBMPCtx (im, fg, out);
|
||||||
|
- rv = gdDPExtractData (out, size);
|
||||||
|
+ if (out == NULL) return NULL;
|
||||||
|
+ if (!_gdImageWBMPCtx(im, fg, out)) {
|
||||||
|
+ rv = gdDPExtractData(out, size);
|
||||||
|
+ } else {
|
||||||
|
+ rv = NULL;
|
||||||
|
+ }
|
||||||
|
out->free (out);
|
||||||
|
return rv;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.20.1
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue