File gegl-limit-buffer.patch of Package gegl.22281
From c83b05d565a1e3392c9606a4ecaa560eb9a4ee29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=98yvind=20Kol=C3=A5s?= <pippin@gimp.org>
Date: Sat, 14 Apr 2018 14:26:37 +0200
Subject: [PATCH] ppm-load: limit max permitted buffer allocation to 2GB
Fixing bug #795248
---
operations/external/ppm-load.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
Index: gegl-0.2.0/operations/external/ppm-load.c
===================================================================
--- gegl-0.2.0.orig/operations/external/ppm-load.c
+++ gegl-0.2.0/operations/external/ppm-load.c
@@ -132,9 +132,14 @@ ppm_load_read_header(FILE *fp,
}
/* Later on, img->numsamples is multiplied with img->bpc to allocate
- * memory. Ensure it doesn't overflow. */
+ * memory. Ensure it doesn't overflow. G_MAXSIZE might have been
+ good enough on 32bit, for now lets just fail if the size is beyond
+ 2GB
+ */
+#define MAX_PPM_SIZE (1<<31)
+
if (!img->width || !img->height ||
- G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+ MAX_PPM_SIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
{
g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
return FALSE;