b874ab977f
"Multiple buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to execute arbitrary code via certain image files." (1.9.15 is also affected) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1026 Patch from Pavel Kankovsky.
89 lines
2 KiB
Text
89 lines
2 KiB
Text
$NetBSD: patch-aj,v 1.1 2004/12/10 09:30:42 salo Exp $
|
|
|
|
--- Imlib/utils.c.orig 2004-09-21 02:22:59.000000000 +0200
|
|
+++ Imlib/utils.c 2004-12-10 09:58:18.000000000 +0100
|
|
@@ -1496,36 +1496,56 @@
|
|
context = 0;
|
|
ptr = NULL;
|
|
end = NULL;
|
|
+ memset(lookup, 0, sizeof(lookup));
|
|
|
|
while (!done)
|
|
{
|
|
line = data[count++];
|
|
+ if (!line)
|
|
+ break;
|
|
+ line = strdup(line);
|
|
+ if (!line)
|
|
+ break;
|
|
+ len = strlen(line);
|
|
+ for (i = 0; i < len; ++i)
|
|
+ {
|
|
+ c = line[i];
|
|
+ if (c < 32)
|
|
+ line[i] = 32;
|
|
+ else if (c > 127)
|
|
+ line[i] = 127;
|
|
+ }
|
|
+
|
|
if (context == 0)
|
|
{
|
|
/* Header */
|
|
sscanf(line, "%i %i %i %i", &w, &h, &ncolors, &cpp);
|
|
- if (ncolors > 32766)
|
|
+ if (ncolors <= 0 || ncolors > 32766)
|
|
{
|
|
fprintf(stderr, "IMLIB ERROR: XPM data wth colors > 32766 not supported\n");
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
- if (cpp > 5)
|
|
+ if (cpp <= 0 || cpp > 5)
|
|
{
|
|
fprintf(stderr, "IMLIB ERROR: XPM data with characters per pixel > 5 not supported\n");
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
- if (w > 32767)
|
|
+ if (w <= 0 || w > 32767)
|
|
{
|
|
fprintf(stderr, "IMLIB ERROR: Image width > 32767 pixels for data\n");
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
- if (h > 32767)
|
|
+ if (h <= 0 || h > 32767)
|
|
{
|
|
fprintf(stderr, "IMLIB ERROR: Image height > 32767 pixels for data\n");
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
cmap = malloc(sizeof(struct _cmap) * ncolors);
|
|
@@ -1533,6 +1553,7 @@
|
|
if (!cmap)
|
|
{
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
im->rgb_width = w;
|
|
@@ -1542,6 +1563,7 @@
|
|
{
|
|
free(cmap);
|
|
free(im);
|
|
+ free(line);
|
|
return NULL;
|
|
}
|
|
im->alpha_data = NULL;
|
|
@@ -1817,6 +1839,7 @@
|
|
}
|
|
if ((ptr) && ((ptr - im->rgb_data) >= w * h * 3))
|
|
done = 1;
|
|
+ free(line);
|
|
}
|
|
if (!transp)
|
|
{
|