diff options
Diffstat (limited to 'gnu/packages/patches/gd-CVE-2016-6128.patch')
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2016-6128.patch | 253 |
1 files changed, 0 insertions, 253 deletions
diff --git a/gnu/packages/patches/gd-CVE-2016-6128.patch b/gnu/packages/patches/gd-CVE-2016-6128.patch deleted file mode 100644 index 45ee6b0cfa..0000000000 --- a/gnu/packages/patches/gd-CVE-2016-6128.patch +++ /dev/null @@ -1,253 +0,0 @@ -Fix CVE-2016-6128 (invalid color index is not properly handled leading -to denial of service). - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6128 - -Copied from upstream commits: -https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd - -From 1ccfe21e14c4d18336f9da8515cd17db88c3de61 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:17:39 +0700 -Subject: [PATCH 1/8] fix php 72494, invalid color index not handled, can lead - to crash - ---- - src/gd_crop.c | 4 ++++ - tests/CMakeLists.txt | 1 + - tests/Makefile.am | 1 + - 3 files changed, 6 insertions(+) - -diff --git a/src/gd_crop.c b/src/gd_crop.c -index 0296633..532b49b 100644 ---- a/src/gd_crop.c -+++ b/src/gd_crop.c -@@ -136,6 +136,10 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c - return NULL; - } - -+ if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) { -+ return NULL; -+ } -+ - /* TODO: Add gdImageGetRowPtr and works with ptr at the row level - * for the true color and palette images - * new formats will simply work with ptr -diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt -index 6f5c786..5093d52 100644 ---- a/tests/CMakeLists.txt -+++ b/tests/CMakeLists.txt -@@ -31,6 +31,7 @@ if (BUILD_TEST) - gdimagecolortransparent - gdimagecopy - gdimagecopyrotated -+ gdimagecrop - gdimagefile - gdimagefill - gdimagefilledellipse -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 4f6e756..5a0ebe8 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -25,6 +25,7 @@ include gdimagecolorresolve/Makemodule.am - include gdimagecolortransparent/Makemodule.am - include gdimagecopy/Makemodule.am - include gdimagecopyrotated/Makemodule.am -+include gdimagecrop/Makemodule.am - include gdimagefile/Makemodule.am - include gdimagefill/Makemodule.am - include gdimagefilledellipse/Makemodule.am --- -2.9.1 - -From 8c9f39c7cb1f62ea00bc7a48aff64d3811c2d6d0 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:20:07 +0700 -Subject: [PATCH 2/8] fix php 72494, invalid color index not handled, can lead - to crash - ---- - tests/gdimagecrop/.gitignore | 1 + - 1 file changed, 1 insertion(+) - create mode 100644 tests/gdimagecrop/.gitignore - -diff --git a/tests/gdimagecrop/.gitignore b/tests/gdimagecrop/.gitignore -new file mode 100644 -index 0000000..8e8c9c3 ---- /dev/null -+++ b/tests/gdimagecrop/.gitignore -@@ -0,0 +1 @@ -+/php_bug_72494 --- -2.9.1 - -From 8de370b7b6263a02268037a7cd13ddd991b43ea9 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:24:50 +0700 -Subject: [PATCH 3/8] fix php 72494, invalid color index not handled, can lead - to crash - ---- - tests/gdimagecrop/CMakeLists.txt | 5 +++++ - 1 file changed, 5 insertions(+) - create mode 100644 tests/gdimagecrop/CMakeLists.txt - -diff --git a/tests/gdimagecrop/CMakeLists.txt b/tests/gdimagecrop/CMakeLists.txt -new file mode 100644 -index 0000000..f7e4c7e ---- /dev/null -+++ b/tests/gdimagecrop/CMakeLists.txt -@@ -0,0 +1,5 @@ -+SET(TESTS_FILES -+ php_bug_72494 -+) -+ -+ADD_GD_TESTS() --- -2.9.1 - -From bca12e4e11ecda8a0ea719472700ad5c2b36a0d6 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:25:12 +0700 -Subject: [PATCH 4/8] fix php 72494, invalid color index not handled, can lead - to crash - ---- - tests/gdimagecrop/Makemodule.am | 5 +++++ - 1 file changed, 5 insertions(+) - create mode 100644 tests/gdimagecrop/Makemodule.am - -diff --git a/tests/gdimagecrop/Makemodule.am b/tests/gdimagecrop/Makemodule.am -new file mode 100644 -index 0000000..210888b ---- /dev/null -+++ b/tests/gdimagecrop/Makemodule.am -@@ -0,0 +1,5 @@ -+libgd_test_programs += \ -+ gdimagecrop/php_bug_72494 -+ -+EXTRA_DIST += \ -+ gdimagecrop/CMakeLists.txt --- -2.9.1 - -From 6ff72ae40c7c20ece939afb362d98cc37f4a1c96 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:25:40 +0700 -Subject: [PATCH 5/8] fix php 72494, invalid color index not handled, can lead - to crash - ---- - tests/gdimagecrop/php_bug_72494.c | 23 +++++++++++++++++++++++ - 1 file changed, 23 insertions(+) - create mode 100644 tests/gdimagecrop/php_bug_72494.c - -diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c -new file mode 100644 -index 0000000..adaa379 ---- /dev/null -+++ b/tests/gdimagecrop/php_bug_72494.c -@@ -0,0 +1,23 @@ -+#include <stdio.h> -+#include <stdlib.h> -+#include "gd.h" -+ -+#include "gdtest.h" -+ -+int main() -+{ -+ gdImagePtr im, exp; -+ int error = 0; -+ -+ im = gdImageCreate(50, 50); -+ -+ if (!im) { -+ gdTestErrorMsg("gdImageCreate failed.\n"); -+ return 1; -+ } -+ -+ gdImageCropThreshold(im, 1337, 0); -+ gdImageDestroy(im); -+ /* this bug tests a crash, it never reaches this point if the bug exists*/ -+ return 0; -+} --- -2.9.1 - -From a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:38:07 +0700 -Subject: [PATCH 6/8] fix php 72494, CID 149753, color is unsigned int, remove - useless <0 comparison - ---- - src/gd_crop.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/gd_crop.c b/src/gd_crop.c -index 532b49b..d51ad67 100644 ---- a/src/gd_crop.c -+++ b/src/gd_crop.c -@@ -136,7 +136,7 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c - return NULL; - } - -- if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) { -+ if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) { - return NULL; - } - --- -2.9.1 - -From 907115fbb980862934d0de91af4977a216745039 Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 11:51:40 +0700 -Subject: [PATCH 7/8] fix php 72494, CID 149753, color is unsigned int, remove - useless <0 comparison - ---- - tests/gdimagecrop/php_bug_72494.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c -index adaa379..5cb589b 100644 ---- a/tests/gdimagecrop/php_bug_72494.c -+++ b/tests/gdimagecrop/php_bug_72494.c -@@ -6,7 +6,7 @@ - - int main() - { -- gdImagePtr im, exp; -+ gdImagePtr im; - int error = 0; - - im = gdImageCreate(50, 50); --- -2.9.1 - -From fd623025505e87bba7ec8555eeb72dae4fb0afdc Mon Sep 17 00:00:00 2001 -From: Pierre Joye <pierre.php@gmail.com> -Date: Mon, 27 Jun 2016 12:04:25 +0700 -Subject: [PATCH 8/8] fix php 72494, CID 149753, color is unsigned int, remove - useless <0 comparison - ---- - tests/gdimagecrop/php_bug_72494.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c -index 5cb589b..3bd19be 100644 ---- a/tests/gdimagecrop/php_bug_72494.c -+++ b/tests/gdimagecrop/php_bug_72494.c -@@ -7,7 +7,6 @@ - int main() - { - gdImagePtr im; -- int error = 0; - - im = gdImageCreate(50, 50); - --- -2.9.1 - |