gnu/packages/patches/cairo-CVE-2016-9082.patch

   1 From: Adrian Johnson <ajohnson@redneon.com>
   2 Date: Thu, 20 Oct 2016 21:12:30 +1030
   3 Subject: [PATCH] image: prevent invalid ptr access for > 4GB images
   4
   5 Image data is often accessed using:
   6
   7   image->data + y * image->stride
   8
   9 On 64-bit achitectures if the image data is > 4GB, this computation
  10 will overflow since both y and stride are 32-bit types.
  11
  12 bug report: https://bugs.freedesktop.org/show_bug.cgi?id=98165
  13 patch: https://bugs.freedesktop.org/attachment.cgi?id=127421
  14 ---
  15  boilerplate/cairo-boilerplate.c     | 4 +++-
  16  src/cairo-image-compositor.c        | 4 ++--
  17  src/cairo-image-surface-private.h   | 2 +-
  18  src/cairo-mesh-pattern-rasterizer.c | 2 +-
  19  src/cairo-png.c                     | 2 +-
  20  src/cairo-script-surface.c          | 3 ++-
  21  6 files changed, 10 insertions(+), 7 deletions(-)
  22
  23 diff --git a/boilerplate/cairo-boilerplate.c b/boilerplate/cairo-boilerplate.c
  24 index 7fdbf79..4804dea 100644
  25 --- a/boilerplate/cairo-boilerplate.c
  26 +++ b/boilerplate/cairo-boilerplate.c
  27 @@ -42,6 +42,7 @@
  28  #undef CAIRO_VERSION_H
  29  #include "../cairo-version.h"
  30
  31 +#include <stddef.h>
  32  #include <stdlib.h>
  33  #include <ctype.h>
  34  #include <assert.h>
  35 @@ -976,7 +977,8 @@ cairo_surface_t *
  36  cairo_boilerplate_image_surface_create_from_ppm_stream (FILE *file)
  37  {
  38      char format;
  39 -    int width, height, stride;
  40 +    int width, height;
  41 +    ptrdiff_t stride;
  42      int x, y;
  43      unsigned char *data;
  44      cairo_surface_t *image = NULL;
  45 diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c
  46 index 48072f8..3ca0006 100644
  47 --- a/src/cairo-image-compositor.c
  48 +++ b/src/cairo-image-compositor.c
  49 @@ -1575,7 +1575,7 @@ typedef struct _cairo_image_span_renderer {
  50      pixman_image_t *src, *mask;
  51      union {
  52         struct fill {
  53 -           int stride;
  54 +           ptrdiff_t stride;
  55             uint8_t *data;
  56             uint32_t pixel;
  57         } fill;
  58 @@ -1594,7 +1594,7 @@ typedef struct _cairo_image_span_renderer {
  59         struct finish {
  60             cairo_rectangle_int_t extents;
  61             int src_x, src_y;
  62 -           int stride;
  63 +           ptrdiff_t stride;
  64             uint8_t *data;
  65         } mask;
  66      } u;
  67 diff --git a/src/cairo-image-surface-private.h b/src/cairo-image-surface-private.h
  68 index 8ca694c..7e78d61 100644
  69 --- a/src/cairo-image-surface-private.h
  70 +++ b/src/cairo-image-surface-private.h
  71 @@ -71,7 +71,7 @@ struct _cairo_image_surface {
  72
  73      int width;
  74      int height;
  75 -    int stride;
  76 +    ptrdiff_t stride;
  77      int depth;
  78
  79      unsigned owns_data : 1;
  80 diff --git a/src/cairo-mesh-pattern-rasterizer.c b/src/cairo-mesh-pattern-rasterizer.c
  81 index 1b63ca8..e7f0db6 100644
  82 --- a/src/cairo-mesh-pattern-rasterizer.c
  83 +++ b/src/cairo-mesh-pattern-rasterizer.c
  84 @@ -470,7 +470,7 @@ draw_pixel (unsigned char *data, int width, int height, int stride,
  85         tg += tg >> 16;
  86         tb += tb >> 16;
  87
  88 -       *((uint32_t*) (data + y*stride + 4*x)) = ((ta << 16) & 0xff000000) |
  89 +       *((uint32_t*) (data + y*(ptrdiff_t)stride + 4*x)) = ((ta << 16) & 0xff000000) |
  90             ((tr >> 8) & 0xff0000) | ((tg >> 16) & 0xff00) | (tb >> 24);
  91      }
  92  }
  93 diff --git a/src/cairo-png.c b/src/cairo-png.c
  94 index 562b743..aa8c227 100644
  95 --- a/src/cairo-png.c
  96 +++ b/src/cairo-png.c
  97 @@ -673,7 +673,7 @@ read_png (struct png_read_closure_t *png_closure)
  98      }
  99
 100      for (i = 0; i < png_height; i++)
 101 -        row_pointers[i] = &data[i * stride];
 102 +        row_pointers[i] = &data[i * (ptrdiff_t)stride];
 103
 104      png_read_image (png, row_pointers);
 105      png_read_end (png, info);
 106 diff --git a/src/cairo-script-surface.c b/src/cairo-script-surface.c
 107 index ea0117d..91e4baa 100644
 108 --- a/src/cairo-script-surface.c
 109 +++ b/src/cairo-script-surface.c
 110 @@ -1202,7 +1202,8 @@ static cairo_status_t
 111  _write_image_surface (cairo_output_stream_t *output,
 112                       const cairo_image_surface_t *image)
 113  {
 114 -    int stride, row, width;
 115 +    int row, width;
 116 +    ptrdiff_t stride;
 117      uint8_t row_stack[CAIRO_STACK_BUFFER_SIZE];
 118      uint8_t *rowdata;
 119      uint8_t *data;
 120 --
 121 2.1.4
 122