diff options
| author | miwi <miwi@FreeBSD.org> | 2009-05-17 06:33:17 +0800 |
|---|---|---|
| committer | miwi <miwi@FreeBSD.org> | 2009-05-17 06:33:17 +0800 |
| commit | a2a50cececfba8dee1636192b7bec3d6fa83a37b (patch) | |
| tree | a3c09f3be2c8cd7c5857cac467c36120e98607aa /graphics/libwmf/files | |
| parent | 55fd1ed2215b6a314f316caa84d23e46005d808e (diff) | |
| download | freebsd-ports-gnome-a2a50cececfba8dee1636192b7bec3d6fa83a37b.tar.gz freebsd-ports-gnome-a2a50cececfba8dee1636192b7bec3d6fa83a37b.tar.zst freebsd-ports-gnome-a2a50cececfba8dee1636192b7bec3d6fa83a37b.zip | |
- Fix two remote code execution
PR: 134246
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Security: http://www.vuxml.org/freebsd/6a245f31-4254-11de-b67a-0030843d3802.html
http://www.vuxml.org/freebsd/48aab1d0-4252-11de-b67a-0030843d3802.html
Diffstat (limited to 'graphics/libwmf/files')
| -rw-r--r-- | graphics/libwmf/files/patch-cve-2006-3376 | 27 | ||||
| -rw-r--r-- | graphics/libwmf/files/patch-cve-2009-1364 | 10 |
2 files changed, 37 insertions, 0 deletions
diff --git a/graphics/libwmf/files/patch-cve-2006-3376 b/graphics/libwmf/files/patch-cve-2006-3376 new file mode 100644 index 000000000000..0b48a35b422f --- /dev/null +++ b/graphics/libwmf/files/patch-cve-2006-3376 @@ -0,0 +1,27 @@ +--- src/player.c ++++ src/player.c +@@ -23,6 +23,7 @@ + + #include <stdio.h> + #include <stdlib.h> ++#include <stdint.h> + #include <string.h> + #include <math.h> + +@@ -132,8 +133,14 @@ + } + } + +-/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char)); +- */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); ++ if (MAX_REC_SIZE(API) > UINT32_MAX / 2) ++ { ++ API->err = wmf_E_InsMem; ++ WMF_DEBUG (API,"bailing..."); ++ return (API->err); ++ } ++ ++ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); + + if (ERR (API)) + { WMF_DEBUG (API,"bailing..."); diff --git a/graphics/libwmf/files/patch-cve-2009-1364 b/graphics/libwmf/files/patch-cve-2009-1364 new file mode 100644 index 000000000000..0af8c98d6613 --- /dev/null +++ b/graphics/libwmf/files/patch-cve-2009-1364 @@ -0,0 +1,10 @@ +--- src/extra/gd/gd_clip.c ++++ src/extra/gd/gd_clip.c +@@ -70,6 +70,7 @@ + { more = gdRealloc (im->clip->list,(im->clip->max + 8) * sizeof (gdClipRectangle)); + if (more == 0) return; + im->clip->max += 8; ++ im->clip->list = more; + } + im->clip->list[im->clip->count] = (*rect); + im->clip->count++; |