Contents of /trunk/gimp/patches/gimp-2.2.15-seek_to_and_unpack_pixeldata-overflow.patch
Parent Directory | Revision Log
Revision 268 -
(show annotations)
(download)
Sat Jul 21 00:35:21 2007 UTC (17 years, 2 months ago) by niro
File size: 769 byte(s)
Sat Jul 21 00:35:21 2007 UTC (17 years, 2 months ago) by niro
File size: 769 byte(s)
-security fix
1 | diff -Naur gimp-2.2.15/plug-ins/common/psd.c gimp-2.2.15-fixed/plug-ins/common/psd.c |
2 | --- gimp-2.2.15/plug-ins/common/psd.c 2007-04-17 23:11:24.000000000 +0200 |
3 | +++ gimp-2.2.15-fixed/plug-ins/common/psd.c 2007-07-04 12:01:14.000000000 +0200 |
4 | @@ -1188,7 +1188,7 @@ |
5 | static void |
6 | seek_to_and_unpack_pixeldata(FILE* fd, gint layeri, gint channeli) |
7 | { |
8 | - int width, height; |
9 | + gint width, height; |
10 | guchar *tmpline; |
11 | gint compression; |
12 | guint32 offset = 0; |
13 | @@ -1202,6 +1202,12 @@ |
14 | width = channel->width; |
15 | height = channel->height; |
16 | |
17 | + if (width > G_MAXINT16 || height > G_MAXINT16) |
18 | + { |
19 | + g_message ("Error: Invalid channel dimensions"); |
20 | + gimp_quit (); |
21 | + } |
22 | + |
23 | IFDBG |
24 | { |
25 | printf("\t\t\tLayer (%d) Channel (%d:%d) Compression: %d (%s)\n", |