diff options
| author | root <root@rshg054.dnsready.net> | 2012-01-31 23:14:57 +0000 |
|---|---|---|
| committer | root <root@rshg054.dnsready.net> | 2012-01-31 23:14:57 +0000 |
| commit | c34f78dd37c2a2015d43de5d89748a2f8147ba1b (patch) | |
| tree | 2e3912930db02e8f8cbfa8a58eae203b886fa2d9 /community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch | |
| parent | 902eddd7e029eda6fc1c668b31e696c6ca3edbc7 (diff) | |
Tue Jan 31 23:14:56 UTC 2012
Diffstat (limited to 'community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch')
| -rw-r--r-- | community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch b/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch new file mode 100644 index 000000000..ffb4378aa --- /dev/null +++ b/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch @@ -0,0 +1,48 @@ +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2002-09-27 23:12:40.000000000 +0200 ++++ gdk-pixbuf-0.22.0.patched/gdk-pixbuf/io-bmp.c 2005-03-30 01:33:06.000000000 +0200 +@@ -31,8 +31,6 @@ + #include "gdk-pixbuf-private.h" + #include "gdk-pixbuf-io.h" + +- +- + #if 0 + /* If these structures were unpacked, they would define the two headers of the + * BMP file. After them comes the palette, and then the image data. +@@ -206,7 +204,7 @@ + + if (State == NULL) + return NULL; +- ++ + while (feof(f) == 0) { + length = fread(membuf, 1, sizeof (membuf), f); + if (length > 0) +@@ -245,11 +243,26 @@ + static gboolean + grow_buffer (struct bmp_progressive_state *State) + { +- guchar *tmp = realloc (State->buff, State->BufferSize); ++ guchar *tmp; ++ ++ if (State->BufferSize == 0) { ++#if 0 ++ g_set_error (error, ++ GDK_PIXBUF_ERROR, ++ GDK_PIXBUF_ERROR_CORRUPT_IMAGE, ++ _("BMP image has bogus header data")); ++#endif ++ State->read_state = READ_STATE_ERROR; ++ return FALSE; ++ } ++ ++ tmp = realloc (State->buff, State->BufferSize); ++ + if (!tmp) { + State->read_state = READ_STATE_ERROR; + return FALSE; + } ++ + State->buff = tmp; + return TRUE; + } |