99 lines
4.2 KiB
Plaintext
99 lines
4.2 KiB
Plaintext
$OpenBSD: patch-src_glyphs-eimage_c,v 1.2 2011/01/03 10:44:27 jasper Exp $
|
|
|
|
Security fix for CVE-2009-2688, xemacs: multiple integer overflow flaws.
|
|
|
|
Patch from gentoo.
|
|
|
|
--- src/glyphs-eimage.c.orig Mon Aug 20 21:52:28 2007
|
|
+++ src/glyphs-eimage.c Sun Jan 2 23:29:57 2011
|
|
@@ -407,6 +407,7 @@ jpeg_instantiate (Lisp_Object image_instance, Lisp_Obj
|
|
*/
|
|
|
|
{
|
|
+ UINT_64_BIT pixels_sq;
|
|
int jpeg_gray = 0; /* if we're dealing with a grayscale */
|
|
/* Step 4: set parameters for decompression. */
|
|
|
|
@@ -429,7 +430,10 @@ jpeg_instantiate (Lisp_Object image_instance, Lisp_Obj
|
|
jpeg_start_decompress (&cinfo);
|
|
|
|
/* Step 6: Read in the data and put into EImage format (8bit RGB triples)*/
|
|
-
|
|
+ pixels_sq =
|
|
+ (UINT_64_BIT) cinfo.output_width * (UINT_64_BIT) cinfo.output_height;
|
|
+ if (pixels_sq > ((size_t) -1) / 3)
|
|
+ signal_image_error ("JPEG image too large to instantiate", instantiator);
|
|
unwind.eimage = (unsigned char*) xmalloc (cinfo.output_width * cinfo.output_height * 3);
|
|
if (!unwind.eimage)
|
|
signal_image_error("Unable to allocate enough memory for image", instantiator);
|
|
@@ -671,6 +675,7 @@ gif_instantiate (Lisp_Object image_instance, Lisp_Obje
|
|
{
|
|
ColorMapObject *cmo = unwind.giffile->SColorMap;
|
|
int i, j, row, pass, interlace, slice;
|
|
+ UINT_64_BIT pixels_sq;
|
|
unsigned char *eip;
|
|
/* interlaced gifs have rows in this order:
|
|
0, 8, 16, ..., 4, 12, 20, ..., 2, 6, 10, ..., 1, 3, 5, ... */
|
|
@@ -679,6 +684,9 @@ gif_instantiate (Lisp_Object image_instance, Lisp_Obje
|
|
|
|
height = unwind.giffile->SHeight;
|
|
width = unwind.giffile->SWidth;
|
|
+ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
|
|
+ if (pixels_sq > ((size_t) -1) / (3 * unwind.giffile->ImageCount))
|
|
+ signal_image_error ("GIF image too large to instantiate", instantiator);
|
|
unwind.eimage = (unsigned char*)
|
|
xmalloc (width * height * 3 * unwind.giffile->ImageCount);
|
|
if (!unwind.eimage)
|
|
@@ -937,11 +945,15 @@ png_instantiate (Lisp_Object image_instance, Lisp_Obje
|
|
{
|
|
int y;
|
|
unsigned char **row_pointers;
|
|
+ UINT_64_BIT pixels_sq;
|
|
height = info_ptr->height;
|
|
width = info_ptr->width;
|
|
+ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
|
|
+ if (pixels_sq > ((size_t) -1) / 3)
|
|
+ signal_image_error ("PNG image too large to instantiate", instantiator);
|
|
|
|
/* Wow, allocate all the memory. Truly, exciting. */
|
|
- unwind.eimage = xnew_array_and_zero (unsigned char, width * height * 3);
|
|
+ unwind.eimage = xnew_array_and_zero (unsigned char, pixels_sq * 3);
|
|
/* libpng expects that the image buffer passed in contains a
|
|
picture to draw on top of if the png has any transparencies.
|
|
This could be a good place to pass that in... */
|
|
@@ -994,7 +1006,7 @@ png_instantiate (Lisp_Object image_instance, Lisp_Obje
|
|
png_set_expand (png_ptr);
|
|
/* send grayscale images to RGB too */
|
|
if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY ||
|
|
- info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
|
|
+ info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
|
|
png_set_gray_to_rgb (png_ptr);
|
|
/* we can't handle alpha values */
|
|
if (info_ptr->color_type & PNG_COLOR_MASK_ALPHA)
|
|
@@ -1268,6 +1280,7 @@ tiff_instantiate (Lisp_Object image_instance, Lisp_Obj
|
|
|
|
uint32 *raster;
|
|
unsigned char *ep;
|
|
+ UINT_64_BIT pixels_sq;
|
|
|
|
assert (!NILP (data));
|
|
|
|
@@ -1290,12 +1303,15 @@ tiff_instantiate (Lisp_Object image_instance, Lisp_Obj
|
|
|
|
TIFFGetField (unwind.tiff, TIFFTAG_IMAGEWIDTH, &width);
|
|
TIFFGetField (unwind.tiff, TIFFTAG_IMAGELENGTH, &height);
|
|
- unwind.eimage = (unsigned char *) xmalloc (width * height * 3);
|
|
+ pixels_sq = (UINT_64_BIT) width * (UINT_64_BIT) height;
|
|
+ if (pixels_sq >= 1 << 29)
|
|
+ signal_image_error ("TIFF image too large to instantiate", instantiator);
|
|
+ unwind.eimage = (unsigned char *) xmalloc (pixels_sq * 3);
|
|
|
|
/* #### This is little more than proof-of-concept/function testing.
|
|
It needs to be reimplemented via scanline reads for both memory
|
|
compactness. */
|
|
- raster = (uint32*) _TIFFmalloc (width * height * sizeof (uint32));
|
|
+ raster = (uint32*) _TIFFmalloc ((tsize_t) (pixels_sq * sizeof (uint32)));
|
|
if (raster != NULL)
|
|
{
|
|
int i,j;
|