0001-bmp-check-return-value-in-gdImageBmpPtr.patch 2.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980
  1. From ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 Mon Sep 17 00:00:00 2001
  2. From: Mike Frysinger <vapier@gentoo.org>
  3. Date: Sat, 14 Jul 2018 13:54:08 -0400
  4. Subject: [PATCH] bmp: check return value in gdImageBmpPtr
  5. Closes #447.
  6. CVE-2018-1000222
  7. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  8. ---
  9. src/gd_bmp.c | 17 ++++++++++++++---
  10. 1 file changed, 14 insertions(+), 3 deletions(-)
  11. diff --git a/src/gd_bmp.c b/src/gd_bmp.c
  12. index bde0b9d..78f40d9 100644
  13. --- a/src/gd_bmp.c
  14. +++ b/src/gd_bmp.c
  15. @@ -47,6 +47,8 @@ static int bmp_read_4bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
  16. static int bmp_read_8bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp_hdr_t *header);
  17. static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info);
  18. +static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression);
  19. +
  20. #define BMP_DEBUG(s)
  21. static int gdBMPPutWord(gdIOCtx *out, int w)
  22. @@ -87,8 +89,10 @@ BGD_DECLARE(void *) gdImageBmpPtr(gdImagePtr im, int *size, int compression)
  23. void *rv;
  24. gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
  25. if (out == NULL) return NULL;
  26. - gdImageBmpCtx(im, out, compression);
  27. - rv = gdDPExtractData(out, size);
  28. + if (!_gdImageBmpCtx(im, out, compression))
  29. + rv = gdDPExtractData(out, size);
  30. + else
  31. + rv = NULL;
  32. out->gd_free(out);
  33. return rv;
  34. }
  35. @@ -141,6 +145,11 @@ BGD_DECLARE(void) gdImageBmp(gdImagePtr im, FILE *outFile, int compression)
  36. compression - whether to apply RLE or not.
  37. */
  38. BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
  39. +{
  40. + _gdImageBmpCtx(im, out, compression);
  41. +}
  42. +
  43. +static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
  44. {
  45. int bitmap_size = 0, info_size, total_size, padding;
  46. int i, row, xpos, pixel;
  47. @@ -148,6 +157,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
  48. unsigned char *uncompressed_row = NULL, *uncompressed_row_start = NULL;
  49. FILE *tmpfile_for_compression = NULL;
  50. gdIOCtxPtr out_original = NULL;
  51. + int ret = 1;
  52. /* No compression if its true colour or we don't support seek */
  53. if (im->trueColor) {
  54. @@ -325,6 +335,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
  55. out_original = NULL;
  56. }
  57. + ret = 0;
  58. cleanup:
  59. if (tmpfile_for_compression) {
  60. #ifdef _WIN32
  61. @@ -338,7 +349,7 @@ cleanup:
  62. if (out_original) {
  63. out_original->gd_free(out_original);
  64. }
  65. - return;
  66. + return ret;
  67. }
  68. static int compress_row(unsigned char *row, int length)
  69. --
  70. 2.20.1