summaryrefslogtreecommitdiff
path: root/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
diff options
context:
space:
mode:
authorroot <root@rshg054.dnsready.net>2012-01-31 23:14:57 +0000
committerroot <root@rshg054.dnsready.net>2012-01-31 23:14:57 +0000
commitc34f78dd37c2a2015d43de5d89748a2f8147ba1b (patch)
tree2e3912930db02e8f8cbfa8a58eae203b886fa2d9 /community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
parent902eddd7e029eda6fc1c668b31e696c6ca3edbc7 (diff)
Tue Jan 31 23:14:56 UTC 2012
Diffstat (limited to 'community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch')
-rw-r--r--community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch48
1 files changed, 48 insertions, 0 deletions
diff --git a/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch b/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
new file mode 100644
index 000000000..ffb4378aa
--- /dev/null
+++ b/community-testing/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
@@ -0,0 +1,48 @@
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2002-09-27 23:12:40.000000000 +0200
++++ gdk-pixbuf-0.22.0.patched/gdk-pixbuf/io-bmp.c 2005-03-30 01:33:06.000000000 +0200
+@@ -31,8 +31,6 @@
+ #include "gdk-pixbuf-private.h"
+ #include "gdk-pixbuf-io.h"
+
+-
+-
+ #if 0
+ /* If these structures were unpacked, they would define the two headers of the
+ * BMP file. After them comes the palette, and then the image data.
+@@ -206,7 +204,7 @@
+
+ if (State == NULL)
+ return NULL;
+-
++
+ while (feof(f) == 0) {
+ length = fread(membuf, 1, sizeof (membuf), f);
+ if (length > 0)
+@@ -245,11 +243,26 @@
+ static gboolean
+ grow_buffer (struct bmp_progressive_state *State)
+ {
+- guchar *tmp = realloc (State->buff, State->BufferSize);
++ guchar *tmp;
++
++ if (State->BufferSize == 0) {
++#if 0
++ g_set_error (error,
++ GDK_PIXBUF_ERROR,
++ GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
++ _("BMP image has bogus header data"));
++#endif
++ State->read_state = READ_STATE_ERROR;
++ return FALSE;
++ }
++
++ tmp = realloc (State->buff, State->BufferSize);
++
+ if (!tmp) {
+ State->read_state = READ_STATE_ERROR;
+ return FALSE;
+ }
++
+ State->buff = tmp;
+ return TRUE;
+ }