gnu/packages/patches/freeimage-CVE-2016-5684.patch

   1 From: Debian Science Maintainers
   2  <debian-science-maintainers@lists.alioth.debian.org>
   3 Date: Mon, 10 Oct 2016 08:22:44 +0100
   4 Subject: CVE-2016-5684
   5
   6 ---
   7  Source/FreeImage/PluginXPM.cpp | 7 ++++++-
   8  1 file changed, 6 insertions(+), 1 deletion(-)
   9
  10 diff --git a/Source/FreeImage/PluginXPM.cpp b/Source/FreeImage/PluginXPM.cpp
  11 index a698321..cc7bd07 100644
  12 --- a/Source/FreeImage/PluginXPM.cpp
  13 +++ b/Source/FreeImage/PluginXPM.cpp
  14 @@ -181,6 +181,11 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
  15                 }
  16                 free(str);
  17
  18 +               // check info string
  19 +               if((width <= 0) || (height <= 0) || (colors <= 0) || (cpp <= 0)) {
  20 +                       throw "Improperly formed info string";
  21 +               }
  22 +
  23          if (colors > 256) {
  24                         dib = FreeImage_AllocateHeader(header_only, width, height, 24, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
  25                 } else {
  26 @@ -193,7 +198,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
  27                         FILE_RGBA rgba;
  28
  29                         str = ReadString(io, handle);
  30 -                       if(!str)
  31 +                       if(!str || (strlen(str) < (size_t)cpp))
  32                                 throw "Error reading color strings";
  33
  34                         std::string chrs(str,cpp); //create a string for the color chars using the first cpp chars