diff options
| author | Armin Kuster <akuster@mvista.com> | 2016-01-31 07:14:33 -0800 |
|---|---|---|
| committer | Saul Wold <sgw@linux.intel.com> | 2016-02-01 08:24:05 -0800 |
| commit | f2b16d0f9c3ad67fdf63e9e41f42a6d54f1043e4 (patch) | |
| tree | b846195072dc9a9d8652b002908b0d5626308fa5 | |
| parent | 4945643bab1ee6b844115cc747e5c67d874d5fe6 (diff) | |
| download | openembedded-core-f2b16d0f9c3ad67fdf63e9e41f42a6d54f1043e4.tar.gz openembedded-core-f2b16d0f9c3ad67fdf63e9e41f42a6d54f1043e4.tar.bz2 openembedded-core-f2b16d0f9c3ad67fdf63e9e41f42a6d54f1043e4.zip | |
gdk-pixbuf: Security fix CVE-2015-7674
CVE-2015-7674 Heap overflow with a gif file in gdk-pixbuf < 2.32.1
Signed-off-by: Armin Kuster <akuster@mvista.com>
| -rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2015-7674.patch | 39 | ||||
| -rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb | 1 |
2 files changed, 40 insertions, 0 deletions
diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2015-7674.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2015-7674.patch new file mode 100644 index 0000000000..d516e88ab5 --- /dev/null +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2015-7674.patch @@ -0,0 +1,39 @@ +From e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa Mon Sep 17 00:00:00 2001 +From: Benjamin Otte <otte@redhat.com> +Date: Tue, 22 Sep 2015 22:44:51 +0200 +Subject: [PATCH] pixops: Don't overflow variables when shifting them + +If we shift by 16 bits we need to be sure those 16 bits actually exist. +They do now. + +Upstream-status: Backport +https://git.gnome.org/browse/gdk-pixbuf/commit/?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa + +CVE: CVE-2015-7674 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + gdk-pixbuf/pixops/pixops.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +Index: gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c +=================================================================== +--- gdk-pixbuf-2.30.8.orig/gdk-pixbuf/pixops/pixops.c ++++ gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c +@@ -264,11 +264,11 @@ pixops_scale_nearest (guchar *des + double scale_x, + double scale_y) + { +- int i; +- int x; +- int x_step = (1 << SCALE_SHIFT) / scale_x; +- int y_step = (1 << SCALE_SHIFT) / scale_y; +- int xmax, xstart, xstop, x_pos, y_pos; ++ gint64 i; ++ gint64 x; ++ gint64 x_step = (1 << SCALE_SHIFT) / scale_x; ++ gint64 y_step = (1 << SCALE_SHIFT) / scale_y; ++ gint64 xmax, xstart, xstop, x_pos, y_pos; + const guchar *p; + + #define INNER_LOOP(SRC_CHANNELS,DEST_CHANNELS,ASSIGN_PIXEL) \ diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb index 68f3850fb7..dcd01b14ea 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb @@ -18,6 +18,7 @@ SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \ file://run-ptest \ file://fatal-loader.patch \ file://0001-pixops-Be-more-careful-about-integer-overflow.patch \ + file://CVE-2015-7674.patch \ " SRC_URI[md5sum] = "4fed0d54432f1b69fc6e66e608bd5542" |