diff options
Diffstat (limited to 'patches/source/libwmf/libwmf-0.2.8.4-CVE-2016-9317.patch')
| -rw-r--r-- | patches/source/libwmf/libwmf-0.2.8.4-CVE-2016-9317.patch | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/patches/source/libwmf/libwmf-0.2.8.4-CVE-2016-9317.patch b/patches/source/libwmf/libwmf-0.2.8.4-CVE-2016-9317.patch new file mode 100644 index 00000000..cf57734e --- /dev/null +++ b/patches/source/libwmf/libwmf-0.2.8.4-CVE-2016-9317.patch @@ -0,0 +1,21 @@ +--- libwmf-0.2.8.4/src/extra/gd/gd.c ++++ libwmf-0.2.8.4/src/extra/gd/gd.c +@@ -65,6 +65,18 @@ + { + int i; + gdImagePtr im; ++ ++ if (overflow2(sx, sy)) { ++ return NULL; ++ } ++ ++ if (overflow2(sizeof (unsigned char *), sy)) { ++ return NULL; ++ } ++ if (overflow2(sizeof (unsigned char), sx)) { ++ return NULL; ++ } ++ + im = (gdImage *) gdMalloc (sizeof (gdImage)); + memset (im, 0, sizeof (gdImage)); + /* Row-major ever since gd 1.3 */ |