Attachment 627303 Details for Bug 865741 – Patch that should fix this bug

[patch] Patch that should fix this bug

kdelibs-4.3.4-CVE-2012-4513.patch (text/plain), 1.51 KB, created by Jan Grulich on 2012-10-15 11:10:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Grulich

Created: 2012-10-15 11:10:12 UTC

Size: 1.51 KB

patch

obsolete

>diff -rup kdelibs-4.3.4/khtml/imload/scaledimageplane.h kdelibs-4.3.4_fix/khtml/imload/scaledimageplane.h
>--- kdelibs-4.3.4/khtml/imload/scaledimageplane.h	2008-05-21 13:06:09.000000000 +0200
>+++ kdelibs-4.3.4_fix/khtml/imload/scaledimageplane.h	2012-10-15 12:16:55.744408421 +0200
>@@ -24,6 +24,8 @@
> #ifndef SCALED_IMAGE_PLANE_H
> #define SCALED_IMAGE_PLANE_H
> 
>+#include <cassert>
>+
> #include "array2d.h"
> #include "imageplane.h"
> #include "rawimageplane.h"
>@@ -40,7 +42,7 @@ private:
>     RawImagePlane*     parent;
>     Array2D<ImageTile> tiles;
> 
>-    
>+
>     unsigned int* calcScaleTable(unsigned int orig, unsigned int scaled)
>     {
>         if (scaled == 0)
>@@ -48,21 +50,25 @@ private:
> 
>         //### I bet this has all sorts of imprecision problems w/high ratios
>         unsigned int* origin = new unsigned int[scaled];
>-        
>+
>         //### FIXME: replace with something that clamps on right edge later?
>         double ratio    = double(orig)/double(scaled);
>-        int    intRatio = int(ratio*65536.0 + 1);
>-        int    pos      = 0;
>-        
>+
>+        // Should be assured by ImageManager::isAcceptableScaleSize
>+        assert(ratio < 65536);
>+
>+        unsigned intRatio = unsigned(ratio*65536.0 + 1);
>+        unsigned pos      = 0;
>+
>         for (unsigned int pix = 0; pix < scaled; pix++)
>         {
>             origin[pix]  =  pos >> 16;
>             pos          += intRatio;
>         }
>-        
>+
>         return origin;
>     }
>-    
>+
>     unsigned int* xScaleTable;
>     unsigned int* yScaleTable;
> public:

Actions: View | Diff

Attachments on bug 865741: 627303