+++ /dev/null
-From 74c418ba2e41ab9e2287420378a6192788b1fab6 Mon Sep 17 00:00:00 2001
-From: Sarita Rawat <sarita.rawat@samsung.com>
-Date: Fri, 5 Jun 2015 06:56:00 +0000
-Subject: [PATCH] Avoid a possible divide-by-zero
-
-Pointed out in
-
-https://bugzilla.gnome.org/show_bug.cgi?id=750440
----
- gdk-pixbuf/gdk-pixbuf-loader.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gdk-pixbuf/gdk-pixbuf-loader.c b/gdk-pixbuf/gdk-pixbuf-loader.c
-index 65845ed..668b703 100644
---- a/gdk-pixbuf/gdk-pixbuf-loader.c
-+++ b/gdk-pixbuf/gdk-pixbuf-loader.c
-@@ -330,7 +330,7 @@ gdk_pixbuf_loader_prepare (GdkPixbuf *pixbuf,
- else
- anim = gdk_pixbuf_non_anim_new (pixbuf);
-
-- if (priv->needs_scale) {
-+ if (priv->needs_scale && width != 0 && height != 0) {
- priv->animation = GDK_PIXBUF_ANIMATION (_gdk_pixbuf_scaled_anim_new (anim,
- (double) priv->width / width,
- (double) priv->height / height,
---
-2.5.0
-
+++ /dev/null
-From ffec86ed5010c5a2be14f47b33bcf4ed3169a199 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 13 Jul 2015 00:33:40 -0400
-Subject: [PATCH] pixops: Be more careful about integer overflow
-
-Our loader code is supposed to handle out-of-memory and overflow
-situations gracefully, reporting errors instead of aborting. But
-if you load an image at a specific size, we also execute our
-scaling code, which was not careful enough about overflow in some
-places.
-
-This commit makes the scaling code silently return if it fails to
-allocate filter tables. This is the best we can do, since
-gdk_pixbuf_scale() is not taking a GError.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=752297
----
- gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
-index 29a1c14..ce51745 100644
---- a/gdk-pixbuf/pixops/pixops.c
-+++ b/gdk-pixbuf/pixops/pixops.c
-@@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter)
- int i_offset, j_offset;
- int n_x = filter->x.n;
- int n_y = filter->y.n;
-- int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y);
-+ gsize n_weights;
-+ int *weights;
-+
-+ n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
-+ if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
-+ return NULL; /* overflow, bail */
-+
-+ weights = g_try_new (int, n_weights);
-+ if (!weights)
-+ return NULL; /* overflow, bail */
-
- for (i_offset=0; i_offset < SUBSAMPLE; i_offset++)
- for (j_offset=0; j_offset < SUBSAMPLE; j_offset++)
-@@ -1347,8 +1356,11 @@ pixops_process (guchar *dest_buf,
- if (x_step == 0 || y_step == 0)
- return; /* overflow, bail out */
-
-- line_bufs = g_new (guchar *, filter->y.n);
- filter_weights = make_filter_table (filter);
-+ if (!filter_weights)
-+ return; /* overflow, bail out */
-+
-+ line_bufs = g_new (guchar *, filter->y.n);
-
- check_shift = check_size ? get_check_shift (check_size) : 0;
-
-@@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim,
- double scale)
- {
- int n = ceil (1 / scale + 1);
-- double *pixel_weights = g_new (double, SUBSAMPLE * n);
-+ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
- int offset;
- int i;
-
-@@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension *dim,
- }
-
- dim->n = n;
-- dim->weights = g_new (double, SUBSAMPLE * n);
-+ dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
-
- pixel_weights = dim->weights;
-
-@@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim,
- double scale)
- {
- int n = ceil (1/scale + 3.0);
-- double *pixel_weights = g_new (double, SUBSAMPLE * n);
-+ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
- double w;
- int offset, i;
-
---
-2.5.0
-
+++ /dev/null
-From 8dba67cb4f38d62a47757741ad41e3f245b4a32a Mon Sep 17 00:00:00 2001
-From: Benjamin Otte <otte@redhat.com>
-Date: Mon, 17 Aug 2015 18:52:47 +0200
-Subject: [PATCH] pixops: Fix oversight for CVE-2015-4491
-
-The n_x variable could be made large enough to overflow, too.
-
-Also included are various testcases for this vulnerability:
-- The original exploit (adapted for the testsuite)
-- Causing overflow by making both X and Y variables large
-- Causing overflow using only the X variable
-- Causing overflow using only the Y variable
-
-https://bugzilla.gnome.org/show_bug.cgi?id=752297
----
- gdk-pixbuf/pixops/pixops.c | 6 ++-
- 1 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
-index ce51745..7f2cbff 100644
---- a/gdk-pixbuf/pixops/pixops.c
-+++ b/gdk-pixbuf/pixops/pixops.c
-@@ -1275,7 +1275,11 @@ make_filter_table (PixopsFilter *filter)
- gsize n_weights;
- int *weights;
-
-- n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
-+ n_weights = SUBSAMPLE * SUBSAMPLE * n_x;
-+ if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x)
-+ return NULL; /* overflow, bail */
-+
-+ n_weights *= n_y;
- if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
- return NULL; /* overflow, bail */
-
---
-2.5.1
-
+++ /dev/null
-From 2937faff06629e224f113a9af73eba59f65c3845 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 24 Aug 2015 15:20:08 -0400
-Subject: [PATCH] Avoid integer overflow in gdk_pixbuf_add_alpha
-
-Same as before: don't do ptr = base + y * rowstride if y and
-rowstride are integers.
-
-This should fix http://bugzilla.gnome/org/753569
----
- gdk-pixbuf/gdk-pixbuf-util.c | 23 +++++++++++++++--------
- 1 file changed, 15 insertions(+), 8 deletions(-)
-
-diff --git a/gdk-pixbuf/gdk-pixbuf-util.c b/gdk-pixbuf/gdk-pixbuf-util.c
-index 6fbaa8e..6eea4c3 100644
---- a/gdk-pixbuf/gdk-pixbuf-util.c
-+++ b/gdk-pixbuf/gdk-pixbuf-util.c
-@@ -65,12 +65,18 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf,
- {
- GdkPixbuf *new_pixbuf;
- int x, y;
-+ const guint8 *src_pixels;
-+ guint8 *ret_pixels;
-+ const guchar *src;
-+ guchar *dest;
-
- g_return_val_if_fail (GDK_IS_PIXBUF (pixbuf), NULL);
- g_return_val_if_fail (pixbuf->colorspace == GDK_COLORSPACE_RGB, NULL);
- g_return_val_if_fail (pixbuf->n_channels == 3 || pixbuf->n_channels == 4, NULL);
- g_return_val_if_fail (pixbuf->bits_per_sample == 8, NULL);
-
-+ src_pixels = pixbuf->pixels;
-+
- if (pixbuf->has_alpha) {
- new_pixbuf = gdk_pixbuf_copy (pixbuf);
- if (!new_pixbuf)
-@@ -81,17 +87,18 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf,
- } else {
- new_pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, pixbuf->width, pixbuf->height);
- }
--
-+
- if (!new_pixbuf)
- return NULL;
-
-- for (y = 0; y < pixbuf->height; y++) {
-- guchar *src, *dest;
-+ ret_pixels = new_pixbuf->pixels;
-+
-+ for (y = 0; y < pixbuf->height; y++, src_pixels += pixbuf->rowstride, ret_pixels += new_pixbuf->rowstride) {
- guchar tr, tg, tb;
-
-- src = pixbuf->pixels + y * pixbuf->rowstride;
-- dest = new_pixbuf->pixels + y * new_pixbuf->rowstride;
--
-+ src = src_pixels;
-+ dest = ret_pixels;
-+
- if (pixbuf->has_alpha) {
- /* Just subst color, we already copied everything else */
- for (x = 0; x < pixbuf->width; x++) {
-@@ -100,12 +107,12 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf,
- src += 4;
- dest += 4;
- }
-- } else {
-+ } else {
- for (x = 0; x < pixbuf->width; x++) {
- tr = *dest++ = *src++;
- tg = *dest++ = *src++;
- tb = *dest++ = *src++;
--
-+
- if (substitute_color && tr == r && tg == g && tb == b)
- *dest++ = 0;
- else
---
-2.5.1
-
+++ /dev/null
-From fde8d1d12a32740770253e97ddc9602654e16865 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 24 Aug 2015 15:48:51 -0400
-Subject: [PATCH] jpeg: Fix some integer overflows
-
-Similar to the previous commit.
----
- gdk-pixbuf/io-jpeg.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c
-index fa6bec1..eb48aed 100644
---- a/gdk-pixbuf/io-jpeg.c
-+++ b/gdk-pixbuf/io-jpeg.c
-@@ -886,7 +886,7 @@ gdk_pixbuf__jpeg_image_load_lines (JpegProgContext *context,
- return FALSE;
- }
-
-- context->dptr += nlines * context->pixbuf->rowstride;
-+ context->dptr += (gsize)nlines * context->pixbuf->rowstride;
-
- /* send updated signal */
- if (context->updated_func)
-@@ -1494,7 +1494,7 @@ real_save_jpeg (GdkPixbuf *pixbuf,
- while (cinfo.next_scanline < cinfo.image_height) {
- /* convert scanline from ARGB to RGB packed */
- for (j = 0; j < w; j++)
-- memcpy (&(buf[j*3]), &(ptr[i*rowstride + j*n_channels]), 3);
-+ memcpy (&(buf[j*3]), &(ptr[(gsize)i*rowstride + j*n_channels]), 3);
-
- /* write scanline */
- jbuf = (JSAMPROW *)(&buf);
---
-2.5.1
-
+++ /dev/null
-From dd4b061c27dc0865c8f8987d294de6e04b321c18 Mon Sep 17 00:00:00 2001
-From: Benjamin Otte <otte@redhat.com>
-Date: Sat, 22 Aug 2015 23:06:23 +0200
-Subject: [PATCH] pixops: Be smarter than gcc's optimizer
-
-gcc realizes that the overflow checks aren't necessary. Why not?
-
-Well, if an int overflows, the behavior is undefined. And turning on
--fomit-instructions is valid behavior in an undefined situation.
----
- gdk-pixbuf/pixops/pixops.c | 15 +++++++--------
- 1 file changed, 7 insertions(+), 8 deletions(-)
-
-diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
-index b7951c7..5564a40 100644
---- a/gdk-pixbuf/pixops/pixops.c
-+++ b/gdk-pixbuf/pixops/pixops.c
-@@ -1272,18 +1272,17 @@ make_filter_table (PixopsFilter *filter)
- int i_offset, j_offset;
- int n_x = filter->x.n;
- int n_y = filter->y.n;
-- int n_weights;
- int *weights;
-
-- n_weights = SUBSAMPLE * SUBSAMPLE * n_x;
-- if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x)
-- return NULL; /* overflow, bail */
-+ /* check n_x doesn't overflow */
-+ if (G_MAXINT / (SUBSAMPLE * SUBSAMPLE) < n_x)
-+ return NULL;
-
-- n_weights *= n_y;
-- if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
-- return NULL; /* overflow, bail */
-+ /* check n_y doesn't overflow */
-+ if (G_MAXINT / (SUBSAMPLE * SUBSAMPLE * n_x) < n_y)
-+ return NULL;
-
-- weights = g_try_new (int, n_weights);
-+ weights = g_try_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y);
- if (!weights)
- return NULL; /* overflow, bail */
-
---
-2.5.1
-
+++ /dev/null
-From 6df428ba24d8f244d08c4a205053e26b28cee0a9 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 24 Aug 2015 14:44:50 -0400
-Subject: [PATCH] Fix some more integer overflows
-
-The scaling code had a similar problem to the one fixed in the
-previous commit: Expressions like ptr = base + y * rowstride are
-prone to overflow if y and rowstride are (possibly large) integers.
----
- gdk-pixbuf/pixops/pixops.c | 44 ++++++++++++++++++++++----------------------
- 1 file changed, 22 insertions(+), 22 deletions(-)
-
-diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
-index 993223e..33aa32e 100644
---- a/gdk-pixbuf/pixops/pixops.c
-+++ b/gdk-pixbuf/pixops/pixops.c
-@@ -304,8 +304,8 @@ pixops_scale_nearest (guchar *dest_buf,
- guchar *dest;
- y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT;
- y_pos = CLAMP (y_pos, 0, src_height - 1);
-- src = src_buf + y_pos * src_rowstride;
-- dest = dest_buf + i * dest_rowstride;
-+ src = src_buf + (gsize)y_pos * src_rowstride;
-+ dest = dest_buf + (gsize)i * dest_rowstride;
-
- x = render_x0 * x_step + x_step / 2;
-
-@@ -368,8 +368,8 @@ pixops_composite_nearest (guchar *dest_buf,
- guchar *dest;
- y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT;
- y_pos = CLAMP (y_pos, 0, src_height - 1);
-- src = src_buf + y_pos * src_rowstride;
-- dest = dest_buf + i * dest_rowstride;
-+ src = src_buf + (gsize)y_pos * src_rowstride;
-+ dest = dest_buf + (gsize)i * dest_rowstride;
-
- x = render_x0 * x_step + x_step / 2;
-
-@@ -460,8 +460,8 @@ pixops_composite_color_nearest (guchar *dest_buf,
- guchar *dest;
- y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT;
- y_pos = CLAMP (y_pos, 0, src_height - 1);
-- src = src_buf + y_pos * src_rowstride;
-- dest = dest_buf + i * dest_rowstride;
-+ src = src_buf + (gsize)y_pos * src_rowstride;
-+ dest = dest_buf + (gsize)i * dest_rowstride;
-
- x = render_x0 * x_step + x_step / 2;
-
-@@ -1303,7 +1303,7 @@ pixops_process (guchar *dest_buf,
- guchar *new_outbuf;
- guint32 tcolor1, tcolor2;
-
-- guchar *outbuf = dest_buf + dest_rowstride * i;
-+ guchar *outbuf = dest_buf + (gsize)dest_rowstride * i;
- guchar *outbuf_end = outbuf + dest_channels * (render_x1 - render_x0);
-
- if (((i + check_y) >> check_shift) & 1)
-@@ -1322,9 +1322,9 @@ pixops_process (guchar *dest_buf,
- if (y_start < 0)
- line_bufs[j] = (guchar *)src_buf;
- else if (y_start < src_height)
-- line_bufs[j] = (guchar *)src_buf + src_rowstride * y_start;
-+ line_bufs[j] = (guchar *)src_buf + (gsize)src_rowstride * y_start;
- else
-- line_bufs[j] = (guchar *)src_buf + src_rowstride * (src_height - 1);
-+ line_bufs[j] = (guchar *)src_buf + (gsize)src_rowstride * (src_height - 1);
-
- y_start++;
- }
-@@ -1348,7 +1348,7 @@ pixops_process (guchar *dest_buf,
- }
-
- new_outbuf = (*line_func) (run_weights, filter->x.n, filter->y.n,
-- outbuf, dest_x, dest_buf + dest_rowstride *
-+ outbuf, dest_x, dest_buf + (gsize)dest_rowstride *
- i + run_end_index * dest_channels,
- dest_channels, dest_has_alpha,
- line_bufs, src_channels, src_has_alpha,
-@@ -1866,7 +1866,7 @@ _pixops_composite (guchar *dest_buf,
- return;
- #endif
-
-- new_dest_buf = dest_buf + dest_y * dest_rowstride + dest_x * dest_channels;
-+ new_dest_buf = dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * dest_channels;
- render_x0 = dest_x - offset_x;
- render_y0 = dest_y - offset_y;
- render_x1 = dest_x + dest_region_width - offset_x;
-@@ -2026,7 +2026,7 @@ pixops_medialib_composite (guchar *dest_buf,
- if (!use_medialib)
- {
- /* Use non-mediaLib version */
-- _pixops_composite_real (dest_buf + dest_y * dest_rowstride + dest_x *
-+ _pixops_composite_real (dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x *
- dest_channels, dest_x - offset_x, dest_y -
- offset_y, dest_x + dest_region_width - offset_x,
- dest_y + dest_region_height - offset_y,
-@@ -2068,8 +2068,8 @@ pixops_medialib_composite (guchar *dest_buf,
- }
- else
- {
-- mlib_u8 *data = dest_buf + (dest_y * dest_rowstride) +
-- (dest_x * dest_channels);
-+ mlib_u8 *data = dest_buf + (gsize)dest_y * dest_rowstride +
-+ (gsize)dest_x * dest_channels;
-
- mlib_ImageSetStruct (&img_dest, MLIB_BYTE, dest_channels,
- dest_region_width, dest_region_height,
-@@ -2136,8 +2136,8 @@ pixops_medialib_composite (guchar *dest_buf,
- else
- {
- /* Should not happen - Use non-mediaLib version */
-- _pixops_composite_real (dest_buf + dest_y * dest_rowstride +
-- dest_x * dest_channels,
-+ _pixops_composite_real (dest_buf + (gsize)dest_y * dest_rowstride +
-+ (gsize)dest_x * dest_channels,
- dest_x - offset_x, dest_y - offset_y,
- dest_x + dest_region_width - offset_x,
- dest_y + dest_region_height - offset_y,
-@@ -2260,7 +2260,7 @@ _pixops_scale (guchar *dest_buf,
- return;
- #endif
-
-- new_dest_buf = dest_buf + dest_y * dest_rowstride + dest_x * dest_channels;
-+ new_dest_buf = dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * dest_channels;
- render_x0 = dest_x - offset_x;
- render_y0 = dest_y - offset_y;
- render_x1 = dest_x + dest_region_width - offset_x;
-@@ -2314,8 +2314,8 @@ pixops_medialib_scale (guchar *dest_buf,
- */
- if (!use_medialib)
- {
-- _pixops_scale_real (dest_buf + dest_y * dest_rowstride + dest_x *
-- dest_channels, dest_x - offset_x, dest_y - offset_y,
-+ _pixops_scale_real (dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x *
-+ dest_channels, dest_x - offset_x, dest_y - offset_y,
- dest_x + dest_region_width - offset_x,
- dest_y + dest_region_height - offset_y,
- dest_rowstride, dest_channels, dest_has_alpha,
-@@ -2343,8 +2343,8 @@ pixops_medialib_scale (guchar *dest_buf,
- }
- else
- {
-- mlib_u8 *data = dest_buf + (dest_y * dest_rowstride) +
-- (dest_x * dest_channels);
-+ mlib_u8 *data = dest_buf + (gsize)dest_y * dest_rowstride +
-+ (gsize)dest_x * dest_channels;
-
- mlib_ImageSetStruct (&img_dest, MLIB_BYTE, dest_channels,
- dest_region_width, dest_region_height,
-@@ -2379,7 +2379,7 @@ pixops_medialib_scale (guchar *dest_buf,
- int channels = 3;
- int rowstride = (channels * src_width + 3) & ~3;
-
-- tmp_buf = g_malloc (src_rowstride * src_height);
-+ tmp_buf = g_malloc_n (src_rowstride, src_height);
-
- if (src_buf != NULL)
- {
---
-2.5.1
-
+++ /dev/null
-From 3df91dc6c6f8d1421e9c8756959280de792af77a Mon Sep 17 00:00:00 2001
-From: Benjamin Otte <otte@redhat.com>
-Date: Sat, 22 Aug 2015 17:57:23 +0200
-Subject: [PATCH] pixops: Chane variable type
-
-n_weights is used to do overflow checks. So by reducing the size to 32
-bits signed we overflow earlier. This is necessary because further down
-the code lots of code uses int variables to iterate over this variable
-and we don't want those to overflow.
-
-The correct fix would be to make all those variables gsize too, but
-that's way more invasive and requires different checks in different
-places so I'm not gonna do that now.
-And as long as scale factors are not expected to reach G_MAXINT it's not
-really necessary to do this change anyway.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=753908
----
- gdk-pixbuf/pixops/pixops.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
-index 7f2cbff..b7951c7 100644
---- a/gdk-pixbuf/pixops/pixops.c
-+++ b/gdk-pixbuf/pixops/pixops.c
-@@ -1272,7 +1272,7 @@ make_filter_table (PixopsFilter *filter)
- int i_offset, j_offset;
- int n_x = filter->x.n;
- int n_y = filter->y.n;
-- gsize n_weights;
-+ int n_weights;
- int *weights;
-
- n_weights = SUBSAMPLE * SUBSAMPLE * n_x;
---
-2.5.1
-
+++ /dev/null
-From 8714ab407c54d5989d15a78eb15550c2d52d95b8 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 24 Aug 2015 14:13:37 -0400
-Subject: [PATCH] png: Fix some integer overflows
-
-The png loader was not careful enough in some places. Width * height
-can overflow an integer.
-
-This should fix http://bugzilla.gnome.org/734556.
----
- gdk-pixbuf/io-png.c | 15 ++++++++-------
- 1 file changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/gdk-pixbuf/io-png.c b/gdk-pixbuf/io-png.c
-index 3336b1e..5690875 100644
---- a/gdk-pixbuf/io-png.c
-+++ b/gdk-pixbuf/io-png.c
-@@ -267,6 +267,7 @@ gdk_pixbuf__png_image_load (FILE *f, GError **error)
- gchar *density_str;
- guint32 retval;
- gint compression_type;
-+ gpointer ptr;
-
- #ifdef PNG_USER_MEM_SUPPORTED
- png_ptr = png_create_read_struct_2 (PNG_LIBPNG_VER_STRING,
-@@ -326,8 +327,8 @@ gdk_pixbuf__png_image_load (FILE *f, GError **error)
-
- rows = g_new (png_bytep, h);
-
-- for (i = 0; i < h; i++)
-- rows[i] = pixbuf->pixels + i * pixbuf->rowstride;
-+ for (i = 0, ptr = pixbuf->pixels; i < h; i++, ptr += pixbuf->rowstride)
-+ rows[i] = ptr;
-
- png_read_image (png_ptr, rows);
- png_read_end (png_ptr, info_ptr);
-@@ -745,6 +746,7 @@ png_row_callback (png_structp png_read_ptr,
- {
- LoadContext* lc;
- guchar* old_row = NULL;
-+ gsize rowstride;
-
- lc = png_get_progressive_ptr(png_read_ptr);
-
-@@ -770,8 +772,9 @@ png_row_callback (png_structp png_read_ptr,
- lc->max_row_seen_in_chunk = MAX(lc->max_row_seen_in_chunk, ((gint)row_num));
- lc->last_row_seen_in_chunk = row_num;
- lc->last_pass_seen_in_chunk = pass_num;
--
-- old_row = lc->pixbuf->pixels + (row_num * lc->pixbuf->rowstride);
-+
-+ rowstride = lc->pixbuf->rowstride;
-+ old_row = lc->pixbuf->pixels + (row_num * rowstride);
-
- png_progressive_combine_row(lc->png_read_ptr, old_row, new_row);
- }
-@@ -1123,11 +1126,9 @@ static gboolean real_save_png (GdkPixbuf *pixbuf,
- png_set_shift (png_ptr, &sig_bit);
- png_set_packing (png_ptr);
-
-- ptr = pixels;
-- for (y = 0; y < h; y++) {
-+ for (y = 0, ptr = pixels; y < h; y++, ptr += rowstride) {
- row_ptr = (png_bytep)ptr;
- png_write_rows (png_ptr, &row_ptr, 1);
-- ptr += rowstride;
- }
-
- png_write_end (png_ptr, info_ptr);
---
-2.5.1
-
+++ /dev/null
-From 4f68cb78a5277f169b9531e6998c00c7976594e4 Mon Sep 17 00:00:00 2001
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Mon, 24 Aug 2015 15:29:36 -0400
-Subject: [PATCH] Avoid integer overflow in gdk_pixbuf_rotate_simple
-
-Same as before: don't do ptr = base + y * rowstride if y and
-rowstride are integers.
----
- gdk-pixbuf/gdk-pixbuf-scale.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gdk-pixbuf/gdk-pixbuf-scale.c b/gdk-pixbuf/gdk-pixbuf-scale.c
-index 4288c65..475126a 100644
---- a/gdk-pixbuf/gdk-pixbuf-scale.c
-+++ b/gdk-pixbuf/gdk-pixbuf-scale.c
-@@ -396,7 +396,7 @@ gdk_pixbuf_composite_color_simple (const GdkPixbuf *src,
- return dest;
- }
-
--#define OFFSET(pb, x, y) ((x) * (pb)->n_channels + (y) * (pb)->rowstride)
-+#define OFFSET(pb, x, y) ((x) * (pb)->n_channels + (gsize)(y) * (pb)->rowstride)
-
- /**
- * gdk_pixbuf_rotate_simple:
---
-2.5.1
-
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
- <herd>gnome</herd>
+<herd>gnome</herd>
</pkgmetadata>
projects / gentoo.git / commitdiff