rpms/cups/F-7 cups-CVE-2008-1722.patch,NONE,1.1
Tim Waugh (twaugh)
fedora-extras-commits at redhat.com
Fri May 9 11:01:37 UTC 2008
- Previous message (by thread): rpms/rsh/devel netkit-rsh-0.17-arg_max.patch, 1.1, 1.2 netkit-rsh-0.17-audit.patch, 1.2, 1.3 rlogin.pam, 1.6, 1.7 rsh.pam, 1.6, 1.7 rsh.spec, 1.45, 1.46
- Next message (by thread): rpms/tk/devel tk.spec,1.51,1.52
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: twaugh
Update of /cvs/pkgs/rpms/cups/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv18122
Added Files:
cups-CVE-2008-1722.patch
Log Message:
* Fri May 9 2008 Tim Waugh <twaugh at redhat.com> 1:1.2.12-11
- Applied patch to fix CVE-2008-1722 (integer overflow in image filter,
bug #441692, STR #2790).
cups-CVE-2008-1722.patch:
--- NEW FILE cups-CVE-2008-1722.patch ---
diff -up cups-1.2.12/filter/image-png.c.CVE-2008-1722 cups-1.2.12/filter/image-png.c
--- cups-1.2.12/filter/image-png.c.CVE-2008-1722 2006-05-11 12:41:36.000000000 +0100
+++ cups-1.2.12/filter/image-png.c 2008-05-09 11:43:29.000000000 +0100
@@ -3,6 +3,7 @@
*
* PNG image routines for the Common UNIX Printing System (CUPS).
*
+ * Copyright 2007-2008 by Apple Inc.
* Copyright 1993-2006 by Easy Software Products.
*
* These coded instructions, statements, and computer programs are the
@@ -179,16 +180,56 @@ _cupsImageReadPNG(
* Interlaced images must be loaded all at once...
*/
+ size_t bufsize; /* Size of buffer */
+
+
if (color_type == PNG_COLOR_TYPE_GRAY ||
color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
- in = malloc(img->xsize * img->ysize);
+ {
+ bufsize = img->xsize * img->ysize;
+
+ if ((bufsize / img->ysize) != img->xsize)
+ {
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
+ (unsigned)img->xsize, (unsigned)img->ysize);
+ fclose(fp);
+ return (1);
+ }
+ }
else
- in = malloc(img->xsize * img->ysize * 3);
+ {
+ bufsize = img->xsize * img->ysize * 3;
+
+ if ((bufsize / (img->ysize * 3)) != img->xsize)
+ {
+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n",
+ (unsigned)img->xsize, (unsigned)img->ysize);
+ fclose(fp);
+ return (1);
+ }
+ }
+
+ in = malloc(bufsize);
}
bpp = cupsImageGetDepth(img);
out = malloc(img->xsize * bpp);
+ if (!in || !out)
+ {
+ fputs("DEBUG: Unable to allocate memory for PNG image!\n", stderr);
+
+ if (in)
+ free(in);
+
+ if (out)
+ free(out);
+
+ fclose(fp);
+
+ return (1);
+ }
+
/*
* Read the image, interlacing as needed...
*/
- Previous message (by thread): rpms/rsh/devel netkit-rsh-0.17-arg_max.patch, 1.1, 1.2 netkit-rsh-0.17-audit.patch, 1.2, 1.3 rlogin.pam, 1.6, 1.7 rsh.pam, 1.6, 1.7 rsh.spec, 1.45, 1.46
- Next message (by thread): rpms/tk/devel tk.spec,1.51,1.52
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list