diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/image.scm | 3 | ||||
| -rw-r--r-- | gnu/packages/patches/freeimage-CVE-2016-5684.patch | 34 |
3 files changed, 37 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 521ba2d206..a9343f009f 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -527,6 +527,7 @@ dist_patch_DATA = \ %D%/packages/patches/fontconfig-CVE-2016-5384.patch \ %D%/packages/patches/fontforge-svg-modtime.patch \ %D%/packages/patches/freeimage-CVE-2015-0852.patch \ + %D%/packages/patches/freeimage-CVE-2016-5684.patch \ %D%/packages/patches/gawk-fts-test.patch \ %D%/packages/patches/gawk-shell.patch \ %D%/packages/patches/gcc-arm-link-spec-fix.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index b286089713..27060d5ff1 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -581,7 +581,8 @@ supplies a generic doubly-linked list and some string functions.") (sha256 (base32 "12bz57asdcfsz3zr9i9nska0fb6h3z2aizy412qjqkixkginbz7v")) - (patches (search-patches "freeimage-CVE-2015-0852.patch")))) + (patches (search-patches "freeimage-CVE-2015-0852.patch" + "freeimage-CVE-2016-5684.patch")))) (build-system gnu-build-system) (arguments '(#:phases (alist-delete diff --git a/gnu/packages/patches/freeimage-CVE-2016-5684.patch b/gnu/packages/patches/freeimage-CVE-2016-5684.patch new file mode 100644 index 0000000000..2fc02d7b0d --- /dev/null +++ b/gnu/packages/patches/freeimage-CVE-2016-5684.patch @@ -0,0 +1,34 @@ +From: Debian Science Maintainers + <debian-science-maintainers@lists.alioth.debian.org> +Date: Mon, 10 Oct 2016 08:22:44 +0100 +Subject: CVE-2016-5684 + +--- + Source/FreeImage/PluginXPM.cpp | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/Source/FreeImage/PluginXPM.cpp b/Source/FreeImage/PluginXPM.cpp +index a698321..cc7bd07 100644 +--- a/Source/FreeImage/PluginXPM.cpp ++++ b/Source/FreeImage/PluginXPM.cpp +@@ -181,6 +181,11 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) { + } + free(str); + ++ // check info string ++ if((width <= 0) || (height <= 0) || (colors <= 0) || (cpp <= 0)) { ++ throw "Improperly formed info string"; ++ } ++ + if (colors > 256) { + dib = FreeImage_AllocateHeader(header_only, width, height, 24, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK); + } else { +@@ -193,7 +198,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) { + FILE_RGBA rgba; + + str = ReadString(io, handle); +- if(!str) ++ if(!str || (strlen(str) < (size_t)cpp)) + throw "Error reading color strings"; + + std::string chrs(str,cpp); //create a string for the color chars using the first cpp chars |