Attachment 151140 Details for Bug 233705 – extracted from ubuntu cumulative diff

[patch] extracted from ubuntu cumulative diff

xmms-1.2.10-ubuntu-CVE-2007-0653.patch (text/plain), 1.04 KB, created by Michael Shigorin on 2007-03-28 18:06:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Shigorin

Created: 2007-03-28 18:06:37 UTC

Size: 1.04 KB

patch

obsolete

>--- xmms-1.2.10+cvs20060429.orig/xmms/bmp.c
>+++ xmms-1.2.10+cvs20060429/xmms/bmp.c
>@@ -19,6 +19,12 @@
>  */
> #include "xmms.h"
> 
>+#if HAVE_STDINT_H
>+#include <stdint.h>
>+#elif !defined(UINT32_MAX)
>+#define UINT32_MAX 0xffffffffU
>+#endif
>+
> typedef struct tagRGBQUAD
> {
> 	guchar rgbBlue;
>@@ -184,7 +190,7 @@
> 	}
> 	else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
> 	{
>-		gint ncols, i;
>+		guint32 ncols, i;
> 
> 		ncols = offset - headSize - 14;
> 		if (headSize == 12)
>@@ -200,10 +206,18 @@
> 		}
> 	}
> 	fseek(file, offset, SEEK_SET);
>+	/* verify buffer size */
>+	if (!h || !w ||
>+	    w > (((UINT32_MAX - 3) / 3) / h) ||
>+	    h > (((UINT32_MAX - 3) / 3) / w)) {
>+		g_warning("read_bmp(): width(%u)*height(%u) too large", w, h);
>+		fclose(file);
>+		return NULL;
>+	}
>+	data = g_malloc0((w * 3 * h) + 3);	/* +3 is just for safety */
> 	buffer = g_malloc(imgsize);
> 	fread(buffer, imgsize, 1, file);
> 	fclose(file);
>-	data = g_malloc0((w * 3 * h) + 3);	/* +3 is just for safety */
> 
> 	if (bitcount == 1)
> 		read_1b_rgb(buffer, imgsize, data, w, h, rgb_quads);

Actions: View | Diff

Attachments on bug 233705: 151140