73a9fe0066
Cox. While these programs are not installed suid root, they are often used to prepare data for processing. These errors may permit remote attackers to cause a denial of service or execute arbitrary code in any programs or scripts that use these graphics conversion tools. http://marc.theaimsgroup.com/?l=bugtraq&m=104644687816522&w=2
23 lines
917 B
Plaintext
23 lines
917 B
Plaintext
$OpenBSD: patch-pbm_libpbm1_c,v 1.1 2003/03/29 04:13:54 brad Exp $
|
|
--- pbm/libpbm1.c.orig Thu Jan 3 15:09:23 2002
|
|
+++ pbm/libpbm1.c Fri Mar 28 20:22:06 2003
|
|
@@ -36,13 +36,18 @@ pbm_check(FILE * file, const enum pm_che
|
|
const int format, const int cols, const int rows,
|
|
enum pm_check_code * const retval_p) {
|
|
|
|
+ if (rows < 0 || cols < 0)
|
|
+ pm_error("invalid image");
|
|
if (check_type != PM_CHECK_BASIC) {
|
|
if (retval_p) *retval_p = PM_CHECK_UNKNOWN_TYPE;
|
|
} else if (format != RPBM_FORMAT) {
|
|
if (retval_p) *retval_p = PM_CHECK_UNCHECKABLE;
|
|
} else {
|
|
+ /* signed to unsigned so wont wrap */
|
|
const unsigned int bytes_per_row = (cols+7)/8;
|
|
const unsigned int need_raster_size = rows * bytes_per_row;
|
|
+
|
|
+ overflow2(bytes_per_row, rows);
|
|
|
|
pm_check(file, check_type, need_raster_size, retval_p);
|
|
}
|