openbsd-ports/graphics/netpbm/patches/patch-pbm_pbmpage_c
brad 73a9fe0066 Several math overflow errors were found in NetPBM by Al Viro and Alan
Cox.  While these programs are not installed suid root, they are often
used to prepare data for processing.  These errors may permit remote
attackers to cause a denial of service or execute arbitrary code in
any programs or scripts that use these graphics conversion tools.

http://marc.theaimsgroup.com/?l=bugtraq&m=104644687816522&w=2
2003-03-29 04:13:54 +00:00

22 lines
608 B
Plaintext

$OpenBSD: patch-pbm_pbmpage_c,v 1.1 2003/03/29 04:13:54 brad Exp $
--- pbm/pbmpage.c.orig Sat Mar 31 01:58:23 2001
+++ pbm/pbmpage.c Fri Mar 28 20:22:06 2003
@@ -15,6 +15,7 @@
#include <math.h>
#include <stdio.h>
#include <stdlib.h>
+#include <string.h>
#include "pbm.h"
/* Support both US and A4. */
@@ -143,6 +144,9 @@ output_pbm(FILE *file, const int Width,
/* We round the allocated row space up to a multiple of 8 so the ugly
fast code below can work.
*/
+
+ overflow_add(Width, 7);
+
pbmrow = pbm_allocrow(((Width+7)/8)*8);
bitmap_cursor = 0;