b874ab977f
"Multiple buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to execute arbitrary code via certain image files." (1.9.15 is also affected) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1026 Patch from Pavel Kankovsky.
32 lines
823 B
Text
32 lines
823 B
Text
$NetBSD: patch-ai,v 1.2 2004/12/10 09:30:42 salo Exp $
|
|
|
|
--- gdk_imlib/io-ppm.c.orig 2002-03-04 18:06:29.000000000 +0100
|
|
+++ gdk_imlib/io-ppm.c 2004-12-10 10:00:56.000000000 +0100
|
|
@@ -50,15 +50,15 @@
|
|
if (s[0] != '#')
|
|
{
|
|
done = 0;
|
|
- sscanf(s, "%i %i", w, h);
|
|
+ sscanf(s, "%d %d", w, h);
|
|
a = *w;
|
|
b = *h;
|
|
- if (a > 32767)
|
|
+ if (a <= 0 || a > 32767)
|
|
{
|
|
fprintf(stderr, "gdk_imlib ERROR: Image width > 32767 pixels for file\n");
|
|
return NULL;
|
|
}
|
|
- if (b > 32767)
|
|
+ if (b <= 0 || b > 32767)
|
|
{
|
|
fprintf(stderr, "gdk_imlib ERROR: Image height > 32767 pixels for file\n");
|
|
return NULL;
|
|
@@ -66,7 +66,7 @@
|
|
if (!bw)
|
|
{
|
|
fgets(s, 256, f);
|
|
- sscanf(s, "%i", &scale);
|
|
+ sscanf(s, "%d", &scale);
|
|
}
|
|
else
|
|
scale = 99999;
|