-----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA256
+Hash: SHA1
AUX libgdiplus-2.10.1-libpng15.patch 5491 RMD160 6dccbc62607ac95bd1c062a7440199082e6038b0 SHA1 e63eba86cf1b55145de645ebbc54ba4e85d24260 SHA256 ae18bac02341af98ed17b14ee510c33cc87d0637a9cf56fedaf21603aa04198c
-AUX libgdiplus-2.6.7-fix-overflows.patch 7963 RMD160 033ee74060ac3103a4f9d5d8bd8bfc57ddab1fdb SHA1 199fa36eac75a3501befded439d38a8a97fdd5eb SHA256 5e0143cf657d9dee39e4e2226816c5acf12616e329f469a7d468f2baf1630627
DIST libgdiplus-2.10.tar.bz2 1962898 RMD160 5b66e9c00759c24b815a82581efa271d333b058e SHA1 cc88be4db56561039325cfda10a42408d64332d9 SHA256 2d9e0397ef5583ed855eaafcdac8cabbe1d58463ed1e4b545be6dde5b63712a4
-DIST libgdiplus-2.6.7.tar.bz2 1960822 RMD160 577a2815562c1c2bd2adf50f707354fba2aaf2f3 SHA1 bc985e95b79327f224580263671173ef369dc074 SHA256 7ebe427d6486cdab56fb6715e2d14a484e8ffe5cb6f183e133abca7d4f8f7144
-DIST libgdiplus-2.8.1.tar.bz2 1959852 RMD160 b5e9e8877e3e9f3b9af8a6e8e53d511a40407f64 SHA1 00e546a0acacd9155d9347420440ffe15b19f0d1 SHA256 7e99f766a38b81c46fdcd16f2f10d6aa280b4298835fba141a74d6c39ff1e3c9
EBUILD libgdiplus-2.10.ebuild 1164 RMD160 c167232ce826f6b00b0f88cdca89995be41608ca SHA1 41944e4200c3356949e1f22faba8562effe7c53a SHA256 da98d1f979e4fc5becfa61ac2bdd63be8e09fcf4fc584f1a8b0b82d28c38678c
-EBUILD libgdiplus-2.6.7-r1.ebuild 1219 RMD160 ee72809144c3fa4d58441efff61a85d4dca0e08b SHA1 5e753442366d24b27326449baf978b31a2a98f07 SHA256 2c3cf13d349cdd52c87dd6ac5296919c3d9444e713927597fb3a679197831e48
-EBUILD libgdiplus-2.8.1.ebuild 1110 RMD160 619004b210ce5fb57d2a2595562cc4c42612bcf3 SHA1 c5de34265392a161149e24de2bb3c8f8d94d1c6d SHA256 d6e64fafb68810d458302364a997af226787afc8bb247abe8985403df6e7e413
-MISC ChangeLog 21372 RMD160 e3077bb33d34face6067b3e16bd9c7128f2e122e SHA1 02416c0b0d28c63d3cf6c75313e4f2a64ca8a0e1 SHA256 5d9731444210602c096d3364045380353cb6322d5f1f66fce40d9d70caa7fd58
+MISC ChangeLog 21539 RMD160 d536d258c8c5f729f405bb5c89176fd6446e1ca6 SHA1 93ac6aac68aeb59db7c8851bfebc6cba1ba2dd25 SHA256 7decada36b73809dd3d70e08f54a7b45e3aa3e87b9542f7beec80bcff3f43c16
MISC metadata.xml 160 RMD160 cc10b170ad63a746d8bdfbe5bf1bd9f7065922b8 SHA1 49eaf4246f7502850064d3806cce65d3a404ce1b SHA256 1bc3e313a948415fff0dfa63a5610943327146bfe16bfeca603379bf9706a687
-----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.17 (GNU/Linux)
+Version: GnuPG v2.0.18 (GNU/Linux)
-iF4EAREIAAYFAk3K4tMACgkQmWq1bYTyC0NdSgEAthO7PbXw0MLO51wARhb/r6nX
-Gwy+pVux29Og471jDzsA/2JLdaAwnTD6W1OQXHed7/L49WGzEP+fBx13abNEw2FI
-=WJov
+iQEcBAEBAgAGBQJOtUevAAoJEEdUh39IaPFNsL4H/jsus6y9lDSjQnqQE8jCQ0Qt
+MBF/YGS1r9/7z2fo2DDPZ8WBzYdpc+gPPGZnlp1bn0DhEcyuUHihmn/aHczdNBYl
+9Z3vwc5L3stbPmrAIqbOTPEP5Q3pQlkOaSR6R87tC4FAVMf2YndkZi2mx3H+d0ES
+lL/HFtE1r5jtw4iOGJtwb7sGjPGY3t7bOEwnv1wn1mqpMXKMkqsM/zYTmET73Gz2
+bLZ1kmZgnIZ7dOPdL2ARVFY48PN48ItZ2gkiiYrSrunyJwnH+uWOCgxIfa1uVmMI
+BggfDsPLEG10KPnHLKVXkbE2NkmP/wTMYtv38qRIm4k5iaAGv22nB+1YAS5QbC4=
+=qZNd
-----END PGP SIGNATURE-----
+++ /dev/null
-From 6779fbf994d5270720ccb1687ba8b004e20a1821 Mon Sep 17 00:00:00 2001
-From: Sebastien Pouliot <sebastien@ximian.com>
-Date: Mon, 16 Aug 2010 16:48:02 -0400
-Subject: [PATCH] Fix integer overflows when loading images, see bnc #630756
-
-* src/bmpcodec.c:
-* src/jpgcodec.c:
-* src/tifcodec.c:
- Ensure no integer overflow can occur when computing the
- stride or the total pixel size (in bytes) used to load
- pictures in memory. Fix bug #630756
----
- src/bmpcodec.c | 32 +++++++++++++++++++++++---------
- src/jpegcodec.c | 25 +++++++++++++++++++------
- src/tiffcodec.c | 23 ++++++++++++++++++-----
- 3 files changed, 60 insertions(+), 20 deletions(-)
-
-diff --git a/src/bmpcodec.c b/src/bmpcodec.c
-index 7f02561..5547262 100644
---- a/src/bmpcodec.c
-+++ b/src/bmpcodec.c
-@@ -781,7 +781,6 @@ gdip_read_bmp_image (void *pointer, GpImage **image, ImageSource source)
- int colours;
- BOOL os2format = FALSE;
- BOOL upsidedown = TRUE;
-- int size;
- int size_read;
- BYTE *data_read = NULL;
- int line;
-@@ -793,6 +792,7 @@ gdip_read_bmp_image (void *pointer, GpImage **image, ImageSource source)
- ARGB green_mask = 0;
- ARGB blue_mask = 0;
- int red_shift = 0;
-+ unsigned long long int size;
-
- status = gdip_read_BITMAPINFOHEADER (pointer, &bmi, source, &os2format, &upsidedown);
- if (status != Ok)
-@@ -860,23 +860,30 @@ gdip_read_bmp_image (void *pointer, GpImage **image, ImageSource source)
- result->active_bitmap->width = bmi.biWidth;
- result->active_bitmap->height = bmi.biHeight;
-
-+ /* biWidth and biHeight are LONG (32 bits signed integer) */
-+ size = bmi.biWidth;
-+
- switch (result->active_bitmap->pixel_format) {
- case PixelFormat1bppIndexed:
-- result->active_bitmap->stride = (result->active_bitmap->width + 7) / 8;
-+ result->active_bitmap->stride = (size + 7) / 8;
- break;
- case PixelFormat4bppIndexed:
-- result->active_bitmap->stride = (result->active_bitmap->width + 1) / 2;
-+ result->active_bitmap->stride = (size + 1) / 2;
- break;
- case PixelFormat8bppIndexed:
-- result->active_bitmap->stride = result->active_bitmap->width;
-- break;
-- case PixelFormat24bppRGB:
-- result->active_bitmap->stride = result->active_bitmap->width * 4;
-+ result->active_bitmap->stride = size;
- break;
- default:
- /* For other types, we assume 32 bit and translate into 32 bit from source format */
- result->active_bitmap->pixel_format = PixelFormat32bppRGB;
-- result->active_bitmap->stride = result->active_bitmap->width * 4;
-+ /* fall-thru */
-+ case PixelFormat24bppRGB:
-+ /* stride is a (signed) _int_ and once multiplied by 4 it should hold a value that can be allocated by GdipAlloc
-+ * this effectively limits 'width' to 536870911 pixels */
-+ size *= 4;
-+ if (size > G_MAXINT32)
-+ goto error;
-+ result->active_bitmap->stride = size;
- break;
- }
-
-@@ -922,7 +929,14 @@ gdip_read_bmp_image (void *pointer, GpImage **image, ImageSource source)
- data_read = NULL;
- }
-
-- pixels = GdipAlloc (result->active_bitmap->stride * result->active_bitmap->height);
-+ size = result->active_bitmap->stride;
-+ /* ensure total 'size' does not overflow an integer and fits inside our 2GB limit */
-+ size *= result->active_bitmap->height;
-+ if (size > G_MAXINT32) {
-+ status = OutOfMemory;
-+ goto error;
-+ }
-+ pixels = GdipAlloc (size);
- if (pixels == NULL) {
- status = OutOfMemory;
- goto error;
-diff --git a/src/jpegcodec.c b/src/jpegcodec.c
-index 55df776..e330efb 100644
---- a/src/jpegcodec.c
-+++ b/src/jpegcodec.c
-@@ -282,6 +282,7 @@ gdip_load_jpeg_image_internal (struct jpeg_source_mgr *src, GpImage **image)
- BYTE *lines[4] = {NULL, NULL, NULL, NULL};
- GpStatus status;
- int stride;
-+ unsigned long long int size;
-
- destbuf = NULL;
- result = NULL;
-@@ -323,20 +324,21 @@ gdip_load_jpeg_image_internal (struct jpeg_source_mgr *src, GpImage **image)
-
- if (cinfo.num_components == 1) {
- result->cairo_format = CAIRO_FORMAT_A8;
-- result->active_bitmap->stride = cinfo.image_width;
- result->active_bitmap->pixel_format = PixelFormat8bppIndexed;
-+ size = 1;
- } else if (cinfo.num_components == 3) {
- /* libjpeg gives us RGB for many formats and
- * we convert to RGB format when needed. JPEG
- * does not support alpha (transparency). */
- result->cairo_format = CAIRO_FORMAT_ARGB32;
-- result->active_bitmap->stride = 4 * cinfo.image_width;
- result->active_bitmap->pixel_format = PixelFormat24bppRGB;
-+ size = 4;
- } else if (cinfo.num_components == 4) {
- result->cairo_format = CAIRO_FORMAT_ARGB32;
-- result->active_bitmap->stride = 4 * cinfo.image_width;
- result->active_bitmap->pixel_format = PixelFormat32bppRGB;
-- }
-+ size = 4;
-+ } else
-+ goto error;
-
- switch (cinfo.jpeg_color_space) {
- case JCS_GRAYSCALE:
-@@ -360,7 +362,12 @@ gdip_load_jpeg_image_internal (struct jpeg_source_mgr *src, GpImage **image)
- break;
- }
-
-- stride = result->active_bitmap->stride;
-+ size *= cinfo.image_width;
-+ /* stride is a (signed) _int_ and once multiplied by 4 it should hold a value that can be allocated by GdipAlloc
-+ * this effectively limits 'width' to 536870911 pixels */
-+ if (size > G_MAXINT32)
-+ goto error;
-+ stride = result->active_bitmap->stride = size;
-
- /* Request cairo-compat output */
- /* libjpeg can do only following conversions,
-@@ -397,7 +404,13 @@ gdip_load_jpeg_image_internal (struct jpeg_source_mgr *src, GpImage **image)
-
- jpeg_start_decompress (&cinfo);
-
-- destbuf = GdipAlloc (stride * cinfo.output_height);
-+ /* ensure total 'size' does not overflow an integer and fits inside our 2GB limit */
-+ size *= cinfo.output_height;
-+ if (size > G_MAXINT32) {
-+ status = OutOfMemory;
-+ goto error;
-+ }
-+ destbuf = GdipAlloc (size);
- if (destbuf == NULL) {
- status = OutOfMemory;
- goto error;
-diff --git a/src/tiffcodec.c b/src/tiffcodec.c
-index 9e9504f..cf4cf3b 100644
---- a/src/tiffcodec.c
-+++ b/src/tiffcodec.c
-@@ -1104,6 +1104,8 @@ gdip_load_tiff_image (TIFF *tiff, GpImage **image)
- frame = gdip_frame_add(result, &gdip_image_frameDimension_page_guid);
-
- for (page = 0; page < num_of_pages; page++) {
-+ unsigned long long int size;
-+
- bitmap_data = gdip_frame_add_bitmapdata(frame);
- if (bitmap_data == NULL) {
- goto error;
-@@ -1139,14 +1141,25 @@ gdip_load_tiff_image (TIFF *tiff, GpImage **image)
- bitmap_data->image_flags |= ImageFlagsHasRealDPI;
- }
-
-- bitmap_data->stride = tiff_image.width * 4;
-+ /* width and height are uint32, but TIFF uses 32 bits offsets (so it's real size limit is 4GB),
-+ * however libtiff uses signed int (int32 not uint32) as offsets so we limit ourselves to 2GB */
-+ size = tiff_image.width;
-+ /* stride is a (signed) _int_ and once multiplied by 4 it should hold a value that can be allocated by GdipAlloc
-+ * this effectively limits 'width' to 536870911 pixels */
-+ size *= sizeof (guint32);
-+ if (size > G_MAXINT32)
-+ goto error;
-+ bitmap_data->stride = size;
- bitmap_data->width = tiff_image.width;
- bitmap_data->height = tiff_image.height;
- bitmap_data->reserved = GBD_OWN_SCAN0;
- bitmap_data->image_flags |= ImageFlagsColorSpaceRGB | ImageFlagsHasRealPixelSize | ImageFlagsReadOnly;
-
-- num_of_pixels = tiff_image.width * tiff_image.height;
-- pixbuf = GdipAlloc(num_of_pixels * sizeof(guint32));
-+ /* ensure total 'size' does not overflow an integer and fits inside our 2GB limit */
-+ size *= tiff_image.height;
-+ if (size > G_MAXINT32)
-+ goto error;
-+ pixbuf = GdipAlloc (size);
- if (pixbuf == NULL) {
- goto error;
- }
-@@ -1168,9 +1181,9 @@ gdip_load_tiff_image (TIFF *tiff, GpImage **image)
- memcpy(pixbuf + (bitmap_data->stride * (tiff_image.height - i - 1)), pixbuf_row, bitmap_data->stride);
- }
-
-- /* Now flip from ARGB to ABGR */
-+ /* Now flip from ARGB to ABGR processing one pixel (4 bytes) at the time */
- pixbuf_ptr = (guint32 *)pixbuf;
-- for (i = 0; i < num_of_pixels; i++) {
-+ for (i = 0; i < (size >> 2); i++) {
- *pixbuf_ptr = (*pixbuf_ptr & 0xff000000) |
- ((*pixbuf_ptr & 0x00ff0000) >> 16) |
- (*pixbuf_ptr & 0x0000ff00) |
---
-1.7.2.1
-
projects / gentoo.git / commitdiff