Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP2:Update
gd.11952
gd-CVE-2019-6978.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File gd-CVE-2019-6978.patch of Package gd.11952
Index: libgd-2.1.0/src/gd_gif_out.c =================================================================== --- libgd-2.1.0.orig/src/gd_gif_out.c 2019-01-31 09:51:27.033082525 +0100 +++ libgd-2.1.0/src/gd_gif_out.c 2019-01-31 09:59:16.292013665 +0100 @@ -93,13 +93,18 @@ static void char_init(GifCtx *ctx); static void char_out(int c, GifCtx *ctx); static void flush_char(GifCtx *ctx); +static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out); + BGD_DECLARE(void *) gdImageGifPtr(gdImagePtr im, int *size) { void *rv; gdIOCtx *out = gdNewDynamicCtx(2048, NULL); if (out == NULL) return NULL; - gdImageGifCtx(im, out); - rv = gdDPExtractData(out, size); + if (!_gdImageGifCtx(im, out)) { + rv = gdDPExtractData(out, size); + } else { + rv = NULL; + } out->gd_free(out); return rv; } @@ -114,6 +119,12 @@ BGD_DECLARE(void) gdImageGif(gdImagePtr BGD_DECLARE(void) gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) { + _gdImageGifCtx(im, out); +} + +/* returns 0 on success, 1 on failure */ +static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out) +{ gdImagePtr pim = 0, tim = im; int interlace, BitsPerPixel; interlace = im->interlace; @@ -124,7 +135,7 @@ BGD_DECLARE(void) gdImageGifCtx(gdImageP based temporary image. */ pim = gdImageCreatePaletteFromTrueColor(im, 1, 256); if(!pim) { - return; + return 1; } tim = pim; } @@ -140,6 +151,7 @@ BGD_DECLARE(void) gdImageGifCtx(gdImageP /* Destroy palette based temporary image. */ gdImageDestroy( pim); } + return 0; } BGD_DECLARE(void *) gdImageGifAnimBeginPtr(gdImagePtr im, int *size, int GlobalCM, int Loops) Index: libgd-2.1.0/src/gd_jpeg.c =================================================================== --- libgd-2.1.0.orig/src/gd_jpeg.c 2013-06-25 11:58:23.000000000 +0200 +++ libgd-2.1.0/src/gd_jpeg.c 2019-01-31 10:01:34.696878197 +0100 @@ -118,6 +118,8 @@ static void fatal_jpeg_error(j_common_pt exit(99); } +static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality); + /* * Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality * QUALITY. If QUALITY is in the range 0-100, increasing values @@ -140,8 +142,11 @@ BGD_DECLARE(void *) gdImageJpegPtr(gdIma void *rv; gdIOCtx *out = gdNewDynamicCtx(2048, NULL); if (out == NULL) return NULL; - gdImageJpegCtx(im, out, quality); - rv = gdDPExtractData(out, size); + if (!_gdImageJpegCtx(im, out, quality)) { + rv = gdDPExtractData(out, size); + } else { + rv = NULL; + } out->gd_free(out); return rv; } @@ -150,6 +155,12 @@ void jpeg_gdIOCtx_dest(j_compress_ptr ci BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) { + _gdImageJpegCtx(im, outfile, quality); +} + +/* returns 0 on success, 1 on failure */ +static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality) +{ struct jpeg_compress_struct cinfo; struct jpeg_error_mgr jerr; int i, j, jidx; @@ -183,7 +194,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage if(row) { gdFree(row); } - return; + return 1; } cinfo.err->emit_message = jpeg_emit_message; @@ -220,7 +231,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage if(row == 0) { gd_error("gd-jpeg: error: unable to allocate JPEG row structure: gdCalloc returns NULL\n"); jpeg_destroy_compress(&cinfo); - return; + return 1; } rowptr[0] = row; @@ -297,6 +308,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage jpeg_finish_compress(&cinfo); jpeg_destroy_compress(&cinfo); gdFree(row); + return 0; } BGD_DECLARE(gdImagePtr) gdImageCreateFromJpeg(FILE *inFile) Index: libgd-2.1.0/src/gd_wbmp.c =================================================================== --- libgd-2.1.0.orig/src/gd_wbmp.c 2013-06-25 11:58:23.000000000 +0200 +++ libgd-2.1.0/src/gd_wbmp.c 2019-01-31 10:03:39.165628425 +0100 @@ -82,6 +82,8 @@ int gd_getin(void *in) return (gdGetC((gdIOCtx *)in)); } +static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out); + /* gdImageWBMPCtx * -------------- * Write the image as a wbmp file @@ -93,13 +95,19 @@ int gd_getin(void *in) */ BGD_DECLARE(void) gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) { + _gdImageWBMPCtx(image, fg, out); +} + +/* returns 0 on success, 1 on failure */ +static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out) +{ int x, y, pos; Wbmp *wbmp; /* create the WBMP */ if((wbmp = createwbmp(gdImageSX(image), gdImageSY(image), WBMP_WHITE)) == NULL) { gd_error("Could not create WBMP\n"); - return; + return 1; } /* fill up the WBMP structure */ @@ -115,11 +123,15 @@ BGD_DECLARE(void) gdImageWBMPCtx(gdImage /* write the WBMP to a gd file descriptor */ if(writewbmp(wbmp, &gd_putout, out)) { + freewbmp(wbmp); gd_error("Could not save WBMP\n"); + return 1; } /* des submitted this bugfix: gdFree the memory. */ freewbmp(wbmp); + + return 0; } /* gdImageCreateFromWBMPCtx @@ -206,8 +218,11 @@ BGD_DECLARE(void *) gdImageWBMPPtr(gdIma void *rv; gdIOCtx *out = gdNewDynamicCtx(2048, NULL); if (out == NULL) return NULL; - gdImageWBMPCtx(im, fg, out); - rv = gdDPExtractData(out, size); + if (!_gdImageWBMPCtx(im, fg, out)) { + rv = gdDPExtractData(out, size); + } else { + rv = NULL; + } out->gd_free(out); return rv; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
