Fix out-of-bounds access in CMYK to RGB conversion.

From: Patrick Keshishian <pkeshish@gmail.com>
This commit is contained in:
naddy 2009-09-24 20:07:18 +00:00
parent 7b690d6f1a
commit 766623a042
2 changed files with 23 additions and 2 deletions

View File

@ -1,9 +1,9 @@
# $OpenBSD: Makefile,v 1.37 2009/08/10 06:31:45 kili Exp $
# $OpenBSD: Makefile,v 1.38 2009/09/24 20:07:18 naddy Exp $
COMMENT= X11 image display and modification tool
DISTNAME= xv-3.10a
PKGNAME= ${DISTNAME}p7
PKGNAME= ${DISTNAME}p8
CATEGORIES= graphics x11
MASTER_SITES= ftp://ftp.mirrorservice.org/sites/ftp.cis.upenn.edu/pub/xv/ \

View File

@ -0,0 +1,21 @@
$OpenBSD: patch-xvjpeg_c,v 1.1 2009/09/24 20:07:18 naddy Exp $
--- xvjpeg.c.orig Thu Sep 24 21:58:28 2009
+++ xvjpeg.c Thu Sep 24 21:58:45 2009
@@ -696,7 +696,7 @@ L2:
if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* R */
if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* G */
if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* B */
- } while (++q <= pic_end);
+ } while (++q < pic_end);
}
else { /* assume normal data */
register byte *q = pic;
@@ -707,7 +707,7 @@ L2:
if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* R */
if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* G */
if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* B */
- } while (++q <= pic_end);
+ } while (++q < pic_end);
}
pic = realloc(pic,p-pic); /* Release extra storage */
}