author | Rich Burridge <rich.burridge@oracle.com> |
Tue, 31 Jan 2017 11:21:23 -0800 | |
changeset 7626 | a1bbaa35d1ba |
permissions | -rw-r--r-- |
7626
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
Fix for CVE CVE-2016-10167 |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
DOS vulnerability in gdImageCreateFromGd2Ctx() |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
|
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
Change based on commit at: |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
|
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
https://github.com/libgd/libgd/commit/fe9ed49dafa993e3af96b6a5a589efeea9bfb36f |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
|
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
--- gd_gd2.c.orig 2017-01-31 07:09:38.043472825 +0000 |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
9 |
+++ gd_gd2.c 2017-01-31 07:40:06.395740258 +0000 |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
@@ -414,10 +414,9 @@ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
{ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
if (!gdGetInt (&im->tpixels[y][x], in)) |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
{ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
- /*printf("EOF while reading\n"); */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
- /*gdImageDestroy(im); */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
- /*return 0; */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
- im->tpixels[y][x] = 0; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
+ fprintf (stderr, "gd2: EOF while reading\n"); |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
+ gdImageDestroy(im); |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
+ return NULL; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
} |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
} |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
else |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
@@ -425,10 +424,9 @@ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
int ch; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
if (!gdGetByte (&ch, in)) |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
{ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
- /*printf("EOF while reading\n"); */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
- /*gdImageDestroy(im); */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
30 |
- /*return 0; */ |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
31 |
- ch = 0; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
32 |
+ fprintf (stderr, "gd2: EOF while reading\n"); |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
33 |
+ gdImageDestroy(im); |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
34 |
+ return NULL; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
35 |
} |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
36 |
im->pixels[y][x] = ch; |
a1bbaa35d1ba
25475702 problem in LIBRARY/GD2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
37 |
} |