diff options
| author | Andrey A. Chernov <ache@FreeBSD.org> | 2004-07-07 18:33:28 +0800 |
|---|---|---|
| committer | Andrey A. Chernov <ache@FreeBSD.org> | 2004-07-07 18:33:28 +0800 |
| commit | 75ad4985f0a6a89fccf47daad6eeb40e722125d1 (patch) | |
| tree | cde637098d7d2c05410b8fa56420a4b933da0d34 /graphics/png | |
| parent | e5b315a539cc758f8140400853d423083b762574 (diff) | |
| download | freebsd-ports-gnome-75ad4985f0a6a89fccf47daad6eeb40e722125d1.tar.gz freebsd-ports-gnome-75ad4985f0a6a89fccf47daad6eeb40e722125d1.tar.zst freebsd-ports-gnome-75ad4985f0a6a89fccf47daad6eeb40e722125d1.zip | |
In 16-bit samples case the starting offsets for the loops are calculated
incorrectly which may cause a buffer overrun beyond the beginning of
the row buffer.
Submitted by: Robert Nagy <robert@openbsd.org>
Diffstat (limited to 'graphics/png')
| -rw-r--r-- | graphics/png/Makefile | 4 | ||||
| -rw-r--r-- | graphics/png/files/patch-pngrtran.c | 46 |
2 files changed, 48 insertions, 2 deletions
diff --git a/graphics/png/Makefile b/graphics/png/Makefile index eacb963373da..d9a1c89c6b32 100644 --- a/graphics/png/Makefile +++ b/graphics/png/Makefile @@ -6,8 +6,8 @@ # PORTNAME= png -PORTVERSION= 1.2.5 -PORTREVISION= 5 +PORTVERSION= 1.2.5 +PORTREVISION= 6 CATEGORIES= graphics MASTER_SITES= http://www.libpng.org/pub/png/src/ \ ftp://swrinde.nde.swri.edu/pub/png/src/ \ diff --git a/graphics/png/files/patch-pngrtran.c b/graphics/png/files/patch-pngrtran.c new file mode 100644 index 000000000000..1a3a40279cd4 --- /dev/null +++ b/graphics/png/files/patch-pngrtran.c @@ -0,0 +1,46 @@ +--- pngrtran.c.orig Tue Jul 6 17:44:30 2004 ++++ pngrtran.c Tue Jul 6 17:46:22 2004 +@@ -1889,8 +1889,8 @@ png_do_read_filler(png_row_infop row_inf + /* This changes the data from GG to GGXX */ + if (flags & PNG_FLAG_FILLER_AFTER) + { +- png_bytep sp = row + (png_size_t)row_width; +- png_bytep dp = sp + (png_size_t)row_width; ++ png_bytep sp = row + (png_size_t)row_width * 2; ++ png_bytep dp = sp + (png_size_t)row_width * 2; + for (i = 1; i < row_width; i++) + { + *(--dp) = hi_filler; +@@ -1907,8 +1907,8 @@ png_do_read_filler(png_row_infop row_inf + /* This changes the data from GG to XXGG */ + else + { +- png_bytep sp = row + (png_size_t)row_width; +- png_bytep dp = sp + (png_size_t)row_width; ++ png_bytep sp = row + (png_size_t)row_width * 2; ++ png_bytep dp = sp + (png_size_t)row_width * 2; + for (i = 0; i < row_width; i++) + { + *(--dp) = *(--sp); +@@ -1965,8 +1965,8 @@ png_do_read_filler(png_row_infop row_inf + /* This changes the data from RRGGBB to RRGGBBXX */ + if (flags & PNG_FLAG_FILLER_AFTER) + { +- png_bytep sp = row + (png_size_t)row_width * 3; +- png_bytep dp = sp + (png_size_t)row_width; ++ png_bytep sp = row + (png_size_t)row_width * 6; ++ png_bytep dp = sp + (png_size_t)row_width * 2; + for (i = 1; i < row_width; i++) + { + *(--dp) = hi_filler; +@@ -1987,8 +1987,8 @@ png_do_read_filler(png_row_infop row_inf + /* This changes the data from RRGGBB to XXRRGGBB */ + else + { +- png_bytep sp = row + (png_size_t)row_width * 3; +- png_bytep dp = sp + (png_size_t)row_width; ++ png_bytep sp = row + (png_size_t)row_width * 6; ++ png_bytep dp = sp + (png_size_t)row_width * 2; + for (i = 0; i < row_width; i++) + { + *(--dp) = *(--sp);
\ No newline at end of file |