Attachment 584889 Details for Bug 821726 – RHEL-5 backport

[patch] RHEL-5 backport

RHEL5.CVE-2012-1149.patch (text/plain), 7.48 KB, created by Caolan McNamara on 2012-05-16 08:14:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Caolan McNamara

Created: 2012-05-16 08:14:53 UTC

Size: 7.48 KB

patch

obsolete

>diff -ru OOO310_m19/basebmp/source/bitmapdevice.cxx OOO310_m19/basebmp/source/bitmapdevice.cxx
>--- OOO310_m19/basebmp/source/bitmapdevice.cxx	2012-05-15 15:55:58.214156464 +0100
>+++ OOO310_m19/basebmp/source/bitmapdevice.cxx	2012-05-15 16:15:07.292187024 +0100
>@@ -1838,8 +1838,16 @@
>     // factor in bottom-up scanline order case
>     nScanlineStride *= bTopDown ? 1 : -1;
> 
>-    const std::size_t nMemSize( 
>-        (nScanlineStride < 0 ? -nScanlineStride : nScanlineStride)*rSize.getY() );
>+    const sal_uInt32 nWidth(nScanlineStride < 0 ? -nScanlineStride : nScanlineStride);
>+    const sal_uInt32 nHeight(rSize.getY());
>+
>+    if (nHeight && nWidth && nWidth > SAL_MAX_INT32 / nHeight)
>+    {
>+        //suspicious massive alloc
>+        return BitmapDeviceSharedPtr();
>+    }
>+
>+    const std::size_t nMemSize(nWidth * nHeight);
> 
>     if( !pMem )
>     {
>diff -ru OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx
>--- OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx	2012-05-15 15:55:57.571148587 +0100
>+++ OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx	2012-05-15 16:08:32.869391259 +0100
>@@ -344,17 +344,26 @@
> 
> // ------------------------------------------------------------------------
> 
>-void* JPEGReader::CreateBitmap( void* pParam )
>+void* JPEGReader::CreateBitmap( void* _pParam )
> {
>-    Size        aSize( ((JPEGCreateBitmapParam*)pParam)->nWidth,
>-                        ((JPEGCreateBitmapParam*)pParam)->nHeight );
>-    sal_Bool    bGray = ((JPEGCreateBitmapParam*)pParam)->bGray != 0;
>+    JPEGCreateBitmapParam *pParam = (JPEGCreateBitmapParam *) _pParam;
>+
>+    if (pParam->nWidth > SAL_MAX_INT32/8 || pParam->nHeight > SAL_MAX_INT32/8)
>+        return NULL; // avoid overflows later
>+
>+    Size        aSize( pParam->nWidth, pParam->nHeight );
>+    sal_Bool    bGray = pParam->bGray != 0;
> 
> 	void* pBmpBuf = NULL;
> 
> 	if( pAcc )
> 		aBmp.ReleaseAccess( pAcc );
> 
>+    sal_uInt64 nSize = aSize.Width();
>+    nSize *= aSize.Height();
>+    if (nSize > SAL_MAX_INT32 / 24)
>+        return NULL;
>+
> 	if( bGray )
> 	{
> 		BitmapPalette aGrayPal( 256 );
>@@ -375,12 +384,11 @@
>         unsigned long nUnit = ((JPEGCreateBitmapParam*)pParam)->density_unit;
>         
>         if( ( ( 1 == nUnit ) || ( 2 == nUnit ) ) && 
>-            ( (JPEGCreateBitmapParam*) pParam )->X_density && 
>-            ( (JPEGCreateBitmapParam*) pParam )->Y_density )
>+            pParam->X_density && pParam->Y_density )
>         {
>             Point       aEmptyPoint;
>-	        Fraction	aFractX( 1, ((JPEGCreateBitmapParam*)pParam)->X_density );
>-	        Fraction	aFractY( 1, ((JPEGCreateBitmapParam*)pParam)->Y_density );
>+            Fraction    aFractX( 1, pParam->X_density );
>+            Fraction    aFractY( 1, pParam->Y_density );
> 	        MapMode		aMapMode( nUnit == 1 ? MAP_INCH : MAP_CM, aEmptyPoint, aFractX, aFractY );
> 	        Size		aPrefSize = OutputDevice::LogicToLogic( aSize, aMapMode, MAP_100TH_MM );
> 
>@@ -393,8 +401,6 @@
> 
> 	if( pAcc )
> 	{
>-        long nAlignedWidth;
>-
> 		const ULONG nFormat = pAcc->GetScanlineFormat();
> 
> 		if(
>@@ -407,16 +413,15 @@
> 		  )
> 		{
> 			pBmpBuf = pAcc->GetBuffer();
>-			nAlignedWidth = pAcc->GetScanlineSize();
>-			((JPEGCreateBitmapParam*)pParam)->bTopDown = pAcc->IsTopDown();
>+            pParam->nAlignedWidth = pAcc->GetScanlineSize();
>+            pParam->bTopDown = pAcc->IsTopDown();
> 		}
> 		else
> 		{
>-			nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
>-			((JPEGCreateBitmapParam*)pParam)->bTopDown = TRUE;
>-			pBmpBuf = pBuffer = rtl_allocateMemory( nAlignedWidth * aSize.Height() );
>+            pParam->nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
>+            pParam->bTopDown = sal_True;
>+            pBmpBuf = pBuffer = rtl_allocateMemory( pParam->nAlignedWidth * aSize.Height() );
> 		}
>-        ((JPEGCreateBitmapParam*)pParam)->nAlignedWidth = nAlignedWidth;
> 	}
> 
> 	return pBmpBuf;
>diff -ru OOO310_m19/vcl/source/gdi/pngread.cxx OOO310_m19/vcl/source/gdi/pngread.cxx
>--- OOO310_m19/vcl/source/gdi/pngread.cxx	2012-05-15 15:56:04.265230586 +0100
>+++ OOO310_m19/vcl/source/gdi/pngread.cxx	2012-05-15 16:17:07.435648183 +0100
>@@ -202,6 +202,8 @@
> 	mpScanPrior 	( NULL ),
> 	mpTransTab		( NULL ),
> 	mpColorTable	( (sal_uInt8*) mpDefaultColorTable ),
>+    mnPass ( 0 ),
>+    mbPalette( sal_False ),
> 	mbzCodecInUse	( sal_False ),
>     mbStatus( TRUE),
>     mbIDAT( FALSE ),
>@@ -304,7 +306,7 @@
>             nCRC32 = rtl_crc32( nCRC32, &rChunkData.aData[ 0 ], mnChunkLen );
>             maDataIter = rChunkData.aData.begin();
>         }
>-        sal_uInt32 nCheck;
>+        sal_uInt32 nCheck(0);
>         mrPNGStream >> nCheck;
>         if( nCRC32 != nCheck )
>             return false;
>@@ -370,14 +372,23 @@
>     // reset to the first chunk
>     maChunkIter = maChunkSeq.begin();
> 
>-    // parse the chunks
>+    // first chunk must be IDHR
>+    if( mbStatus && ReadNextChunk() )
>+    {
>+        if (mnChunkType == PNGCHUNK_IHDR)
>+            mbStatus = ImplReadHeader( rPreviewSizeHint );
>+        else
>+            mbStatus = false;
>+    }
>+
>+    // parse the remaining chunks
>     while( mbStatus && !mbIDAT && ReadNextChunk() )
>     {
>         switch( mnChunkType )
> 		{
> 			case PNGCHUNK_IHDR :
> 			{
>-				mbStatus = ImplReadHeader( rPreviewSizeHint );
>+                mbStatus = false; //IHDR should only appear as the first chunk
> 			}
> 			break;
> 
>@@ -639,14 +650,6 @@
> 
> 	mnScansize = static_cast< sal_uInt32 >( nScansize64 );
> 
>-    // TODO: switch between both scanlines instead of copying
>-	mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
>-    mpScanCurrent = mpInflateInBuf;
>-	mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
>-
>-	if ( !mpInflateInBuf || !mpScanPrior )
>-		return FALSE;
>-
>     // calculate target size from original size and the preview hint
>     if( rPreviewSizeHint.Width() || rPreviewSizeHint.Height() )
>     {
>@@ -681,6 +684,21 @@
>     maTargetSize.Width()  = (maOrigSize.Width() + mnPreviewMask) >> mnPreviewShift;
>     maTargetSize.Height() = (maOrigSize.Height() + mnPreviewMask) >> mnPreviewShift;
> 
>+    //round bits up to nearest multiple of 8 and divide by 8 to get num of bytes per pixel
>+    int nBytesPerPixel = ((mnTargetDepth + 7) & ~7)/8;
>+
>+    //stupidly big, forget about it
>+    if (maTargetSize.Width() >= SAL_MAX_INT32 / nBytesPerPixel / maTargetSize.Height())
>+        return sal_False;
>+
>+    // TODO: switch between both scanlines instead of copying
>+	mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
>+    mpScanCurrent = mpInflateInBuf;
>+	mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
>+
>+	if ( !mpInflateInBuf || !mpScanPrior )
>+		return FALSE;
>+
>     mpBmp = new Bitmap( maTargetSize, mnTargetDepth );
>     mpAcc = mpBmp->AcquireWriteAccess();
>     if( !mpAcc )
>@@ -792,14 +810,17 @@
> 			{
> 				if ( mnChunkLen <= 256 )
> 				{
>+					mbTransparent = true;
> 					mpTransTab = new BYTE [ 256 ];
> 					rtl_fillMemory( mpTransTab, 256, 0xff );
>-					rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
>-					maDataIter += mnChunkLen;
>-					mbTransparent = true;
>-					// need alpha transparency if not on/off masking
>-					for( int i = 0; i < mnChunkLen; ++i )
>-					   bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
>+					if (mnChunkLen > 0)
>+					{
>+					    rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
>+					    maDataIter += mnChunkLen;
>+					    // need alpha transparency if not on/off masking
>+					    for( int i = 0; i < mnChunkLen; ++i )
>+					       bNeedAlpha |= (mpTransTab[i]!=0x00) && (mpTransTab[i]!=0xFF);
>+                    }
> 				}
> 			}
> 			break;

Actions: View | Diff

Attachments on bug 821726: 584889