File libjpeg-buf-oflo.patch of Package mingw64-jpeg
Dike out a section of code that has no usefulness on Unix-like systems,
and will crash if fed a comment string exceeding 64K. Per report from
Lubomir Kundrak, RH bug #226965
diff -Naur jpeg-6b.orig/wrjpgcom.c jpeg-6b/wrjpgcom.c
--- jpeg-6b.orig/wrjpgcom.c 1997-10-23 00:47:03.000000000 -0400
+++ jpeg-6b/wrjpgcom.c 2007-06-25 22:26:42.000000000 -0400
@@ -446,6 +446,8 @@
} else if (keymatch(arg, "comment", 1)) {
if (++argn >= argc) usage();
comment_arg = argv[argn];
+#if 0
+#error "There is a buffer overflow in the code below"
/* If the comment text starts with '"', then we are probably running
* under MS-DOG and must parse out the quoted string ourselves. Sigh.
*/
@@ -466,6 +468,7 @@
strcat(comment_arg, argv[argn]);
}
}
+#endif
comment_length = (unsigned int) strlen(comment_arg);
} else
usage();