diff options
Diffstat (limited to 'media-libs/tiff/files/tiff-3.9.2-CVE-2010-1411.patch')
| -rw-r--r-- | media-libs/tiff/files/tiff-3.9.2-CVE-2010-1411.patch | 35 |
1 files changed, 0 insertions, 35 deletions
diff --git a/media-libs/tiff/files/tiff-3.9.2-CVE-2010-1411.patch b/media-libs/tiff/files/tiff-3.9.2-CVE-2010-1411.patch deleted file mode 100644 index 7de456578c76..000000000000 --- a/media-libs/tiff/files/tiff-3.9.2-CVE-2010-1411.patch +++ /dev/null @@ -1,35 +0,0 @@ ---- libtiff/tif_fax3.c.orig 2010-05-13 19:36:08.995479161 +0200 -+++ libtiff/tif_fax3.c 2010-05-13 19:48:04.215467428 +0200 -@@ -42,6 +42,7 @@ - #define G3CODES - #include "t4.h" - #include <stdio.h> -+#include <stdint.h> - - /* - * Compression+decompression state blocks are -@@ -493,9 +494,21 @@ - td->td_compression == COMPRESSION_CCITTFAX4 - ); - -- nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels; -+ uint64_t val64 = rowpixels; -+ if (needsRefLine) -+ { -+ val64 = 2*TIFFroundup(rowpixels,32); -+ if (val64 > 0xffffffff) -+ return (0); -+ } -+ nruns = (val64 &0xffffffff); - nruns += 3; -- dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32), -+ -+ val64 = 2*nruns+3; -+ if (val64 > 0xffffffff) -+ return (0); -+ -+ dsp->runs = (uint32*) _TIFFCheckMalloc(tif, (val64 & 0xffffffff), sizeof (uint32), - "for Group 3/4 run arrays"); - if (dsp->runs == NULL) - return (0); - |