File gd-CVE-2021-40812.patch of Package gd.21223
Index: libgd-2.1.0/src/gd_bmp.c
===================================================================
--- libgd-2.1.0.orig/src/gd_bmp.c 2021-09-14 12:09:49.432725961 +0200
+++ libgd-2.1.0/src/gd_bmp.c 2021-09-14 12:09:49.480726253 +0200
@@ -23,6 +23,7 @@
#include <stdlib.h>
#include "gd.h"
#include "gdhelpers.h"
+#include "gd_errors.h"
#include "bmp.h"
static int compress_row(unsigned char *uncompressed_row, int length);
@@ -205,7 +206,11 @@ static int _gdImageBmpCtx(gdImagePtr im,
bitmap_size += compressed_size;
- gdPutBuf(uncompressed_row, compressed_size, out);
+ if (gdPutBuf(uncompressed_row, compressed_size, out) != compressed_size){
+ gd_error("gd-bmp write error\n");
+ error = 1;
+ break;
+ }
Putchar(BMP_RLE_COMMAND, out);
Putchar(BMP_RLE_ENDOFLINE, out);
bitmap_size += 2;
@@ -264,7 +269,10 @@ static int _gdImageBmpCtx(gdImagePtr im,
if (buffer_size == 0) {
break;
}
- gdPutBuf(copy_buffer , buffer_size, out_original);
+ if (gdPutBuf(copy_buffer , buffer_size, out_original) != buffer_size) {
+ gd_error("gd-bmp write error\n");
+ error = 1;
+ }
}
gdFree(copy_buffer);
@@ -274,7 +282,7 @@ static int _gdImageBmpCtx(gdImagePtr im,
out_original = NULL;
}
- ret = 0;
+ ret = error;
cleanup:
if (tmpfile_for_compression) {
#ifdef _WIN32
Index: libgd-2.1.0/src/gd_webp.c
===================================================================
--- libgd-2.1.0.orig/src/gd_webp.c 2021-09-14 12:09:49.480726253 +0200
+++ libgd-2.1.0/src/gd_webp.c 2021-09-14 12:18:42.503960314 +0200
@@ -237,8 +237,13 @@ static int _gdImageWebpCtx (gdImagePtr i
return 1;
}
- gdPutBuf (filedata, yuv_nbytes, outfile);
+ int res = gdPutBuf (filedata, yuv_nbytes, outfile);
free(filedata);
+ if (res != yuv_nbytes) {
+ gd_error("gd-webp write error\n");
+ ret = 1;
+ }
+
return 0;
}