fix borked patch

This commit is contained in:
jasper 2011-09-16 10:42:58 +00:00
parent e820071495
commit 48c3037055

View File

@ -1,4 +1,4 @@
$OpenBSD: patch-packages_xpce_src_img_gifread_c,v 1.1 2011/09/15 15:36:54 jasper Exp $
$OpenBSD: patch-packages_xpce_src_img_gifread_c,v 1.2 2011/09/16 10:42:58 jasper Exp $
From bb328029beb148691edc031d9db9cf0a503c8247 Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
@ -10,8 +10,17 @@ From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Thu, 18 Aug 2011 16:26:44 +0200
Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes.
--- packages/xpce/src/img/gifread.c.orig Wed Sep 14 21:46:22 2011
+++ packages/xpce/src/img/gifread.c Wed Sep 14 21:46:43 2011
--- packages/xpce/src/img/gifread.c.orig Fri Sep 16 12:42:34 2011
+++ packages/xpce/src/img/gifread.c Fri Sep 16 12:42:32 2011
@@ -169,7 +169,7 @@ GIFReadFD(IOSTREAM *fd,
/* read colormaps */
if ( BitSet((UCHAR) buf[4], LOCALCOLORMAP) )
{ if ( (rval=ReadColorMap(fd, GifScreen.BitPixel, at, ac, closure))
- != GIF_OK )
+ != GIF_OK )
{ setGifError("Error reading GIF colormap");
return rval;
}
@@ -466,7 +466,7 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si
firstcode = oldcode = GetCode(fd, code_size, FALSE);
}
@ -21,12 +30,29 @@ Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes.
}
if (sp > stack)
return *--sp;
@@ -505,11 +505,11 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si
@@ -487,11 +487,11 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si
max_code = clear_code + 2;
sp = stack;
firstcode = oldcode = GetCode(fd, code_size, FALSE);
- return firstcode;
- } else if (code == end_code)
+ return (firstcode&255);
+ } else if (code == end_code || code > max_code)
{
int count;
- UCHAR buf[260];
+ UCHAR buf[260]; /* Block buffer */
if (ZeroDataBlock)
return -2;
@@ -504,12 +504,12 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si
}
incode = code;
if (code == max_code)
- if (code >= max_code)
- {
- *sp++ = firstcode;
+ if (code == max_code)
+ { if ( sp < stack+sizeof(stack) ) /* stack is UCHAR */
+ *sp++ = firstcode;
code = oldcode;
@ -46,3 +72,15 @@ Subject: [PATCH] SECURITY: Bug#7: More gif-read fixes.
if ((code = max_code) < (1 << MAX_LZW_BITS))
{
@@ -537,9 +538,9 @@ LZWReadByte(IOSTREAM * fd, int flag, int input_code_si
oldcode = incode;
if (sp > stack)
- return *--sp;
+ return ((*--sp) & 255);
}
- return code;
+ return (code&255);
}