diff options
author | drochner <drochner> | 2009-06-05 10:48:37 +0000 |
---|---|---|
committer | drochner <drochner> | 2009-06-05 10:48:37 +0000 |
commit | 6ec3e25d3bcf6ba95f16963e7c0de8e0fd0db4c5 (patch) | |
tree | 3d725323af05e6f62294700938d2658d0b27e1f8 /multimedia/gst-plugins0.10-good/patches | |
parent | 2c382cf10aab5764544813af453a28b47287540c (diff) | |
download | pkgsrc-6ec3e25d3bcf6ba95f16963e7c0de8e0fd0db4c5.tar.gz |
add a security patch from upstream CVS:
A malformed (or simply huge) PNG file can lead to integer overflow in
calculating the size of the output buffer, leading to crashes or buffer
overflows later. Fixes SA35205 security advisory.
bump PKGREVISION of affected plugin
Diffstat (limited to 'multimedia/gst-plugins0.10-good/patches')
-rw-r--r-- | multimedia/gst-plugins0.10-good/patches/patch-ad | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/multimedia/gst-plugins0.10-good/patches/patch-ad b/multimedia/gst-plugins0.10-good/patches/patch-ad new file mode 100644 index 00000000000..461d933fc9b --- /dev/null +++ b/multimedia/gst-plugins0.10-good/patches/patch-ad @@ -0,0 +1,52 @@ +$NetBSD: patch-ad,v 1.5 2009/06/05 10:48:38 drochner Exp $ + +--- ext/libpng/gstpngdec.c.orig 2009-05-12 02:00:06.000000000 +0200 ++++ ext/libpng/gstpngdec.c +@@ -201,7 +201,14 @@ user_info_callback (png_structp png_ptr, + + /* Allocate output buffer */ + pngdec->rowbytes = png_get_rowbytes (pngdec->png, pngdec->info); +- buffer_size = pngdec->height * GST_ROUND_UP_4 (pngdec->rowbytes); ++ if (pngdec->rowbytes > (G_MAXUINT32 - 3) ++ || pngdec->height > G_MAXUINT32 / pngdec->rowbytes) { ++ ret = GST_FLOW_ERROR; ++ goto beach; ++ } ++ pngdec->rowbytes = GST_ROUND_UP_4 (pngdec->rowbytes); ++ buffer_size = pngdec->height * pngdec->rowbytes; ++ + ret = + gst_pad_alloc_buffer_and_set_caps (pngdec->srcpad, GST_BUFFER_OFFSET_NONE, + buffer_size, GST_PAD_CAPS (pngdec->srcpad), &buffer); +@@ -228,7 +235,7 @@ user_endrow_callback (png_structp png_pt + /* If buffer_out doesn't exist, it means buffer_alloc failed, which + * will already have set the return code */ + if (GST_IS_BUFFER (pngdec->buffer_out)) { +- size_t offset = row_num * GST_ROUND_UP_4 (pngdec->rowbytes); ++ size_t offset = row_num * pngdec->rowbytes; + + GST_LOG ("got row %u, copying in buffer %p at offset %" G_GSIZE_FORMAT, + (guint) row_num, pngdec->buffer_out, offset); +@@ -496,7 +503,12 @@ gst_pngdec_task (GstPad * pad) + + /* Allocate output buffer */ + rowbytes = png_get_rowbytes (pngdec->png, pngdec->info); +- buffer_size = pngdec->height * GST_ROUND_UP_4 (rowbytes); ++ if (rowbytes > (G_MAXUINT32 - 3) || pngdec->height > G_MAXUINT32 / rowbytes) { ++ ret = GST_FLOW_ERROR; ++ goto pause; ++ } ++ rowbytes = GST_ROUND_UP_4 (rowbytes); ++ buffer_size = pngdec->height * rowbytes; + ret = + gst_pad_alloc_buffer_and_set_caps (pngdec->srcpad, GST_BUFFER_OFFSET_NONE, + buffer_size, GST_PAD_CAPS (pngdec->srcpad), &buffer); +@@ -509,7 +521,7 @@ gst_pngdec_task (GstPad * pad) + + for (i = 0; i < pngdec->height; i++) { + rows[i] = inp; +- inp += GST_ROUND_UP_4 (rowbytes); ++ inp += rowbytes; + } + + /* Read the actual picture */ |