File libpng14-1.4.4-CVE-2011-3048.patch of Package libpng14

Overview Repositories Revisions Requests Users Attributes Meta

File libpng14-1.4.4-CVE-2011-3048.patch of Package libpng14

diff -upr libpng-1.4.10/pngset.c libpng-1.4.11/pngset.c
--- libpng-1.4.10/pngset.c      2012-03-15 05:26:49.000000000 +0100
+++ libpng-1.4.11/pngset.c      2012-03-29 07:02:32.000000000 +0200
@@ -649,22 +649,26 @@ png_set_text_2(png_structp png_ptr, png_
     */
    if (info_ptr->num_text + num_text > info_ptr->max_text)
    {
+      int old_max_text = info_ptr->max_text;
+      int old_num_text = info_ptr->num_text;
+
       if (info_ptr->text != NULL)
       {
          png_textp old_text;
-         int old_max;
 
-         old_max = info_ptr->max_text;
          info_ptr->max_text = info_ptr->num_text + num_text + 8;
          old_text = info_ptr->text;
+
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
          {
-            png_free(png_ptr, old_text);
+            /* Restore to previous condition */
+            info_ptr->max_text = old_max_text;
+            info_ptr->text = old_text;
             return(1);
          }
-         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max *
+         png_memcpy(info_ptr->text, old_text, (png_size_t)(old_max_text *
             png_sizeof(png_text)));
          png_free(png_ptr, old_text);
       }
@@ -675,7 +679,12 @@ png_set_text_2(png_structp png_ptr, png_
          info_ptr->text = (png_textp)png_malloc_warn(png_ptr,
             (png_size_t)(info_ptr->max_text * png_sizeof(png_text)));
          if (info_ptr->text == NULL)
+         {
+            /* Restore to previous condition */
+            info_ptr->num_text = old_num_text;
+            info_ptr->max_text = old_max_text;
             return(1);
+         }
          info_ptr->free_me |= PNG_FREE_TEXT;
       }
       png_debug1(3, "allocated %d entries for info_ptr->text",

Places

File libpng14-1.4.4-CVE-2011-3048.patch of Package libpng14

Places