diff options
Diffstat (limited to 'community/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch')
-rw-r--r-- | community/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/community/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch b/community/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch new file mode 100644 index 000000000..ffb4378aa --- /dev/null +++ b/community/gdk-pixbuf/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch @@ -0,0 +1,48 @@ +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2002-09-27 23:12:40.000000000 +0200 ++++ gdk-pixbuf-0.22.0.patched/gdk-pixbuf/io-bmp.c 2005-03-30 01:33:06.000000000 +0200 +@@ -31,8 +31,6 @@ + #include "gdk-pixbuf-private.h" + #include "gdk-pixbuf-io.h" + +- +- + #if 0 + /* If these structures were unpacked, they would define the two headers of the + * BMP file. After them comes the palette, and then the image data. +@@ -206,7 +204,7 @@ + + if (State == NULL) + return NULL; +- ++ + while (feof(f) == 0) { + length = fread(membuf, 1, sizeof (membuf), f); + if (length > 0) +@@ -245,11 +243,26 @@ + static gboolean + grow_buffer (struct bmp_progressive_state *State) + { +- guchar *tmp = realloc (State->buff, State->BufferSize); ++ guchar *tmp; ++ ++ if (State->BufferSize == 0) { ++#if 0 ++ g_set_error (error, ++ GDK_PIXBUF_ERROR, ++ GDK_PIXBUF_ERROR_CORRUPT_IMAGE, ++ _("BMP image has bogus header data")); ++#endif ++ State->read_state = READ_STATE_ERROR; ++ return FALSE; ++ } ++ ++ tmp = realloc (State->buff, State->BufferSize); ++ + if (!tmp) { + State->read_state = READ_STATE_ERROR; + return FALSE; + } ++ + State->buff = tmp; + return TRUE; + } |