diff options
| -rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-pixops-Be-more-careful-about-integer-overflow.patch | 89 | ||||
| -rw-r--r-- | meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.32.1.bb (renamed from meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb) | 5 |
2 files changed, 2 insertions, 92 deletions
diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-pixops-Be-more-careful-about-integer-overflow.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-pixops-Be-more-careful-about-integer-overflow.patch deleted file mode 100644 index fe7c1d5017..0000000000 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-pixops-Be-more-careful-about-integer-overflow.patch +++ /dev/null | |||
| @@ -1,89 +0,0 @@ | |||
| 1 | From ffec86ed5010c5a2be14f47b33bcf4ed3169a199 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Matthias Clasen <mclasen@redhat.com> | ||
| 3 | Date: Mon, 13 Jul 2015 00:33:40 -0400 | ||
| 4 | Subject: [PATCH] pixops: Be more careful about integer overflow | ||
| 5 | |||
| 6 | Our loader code is supposed to handle out-of-memory and overflow | ||
| 7 | situations gracefully, reporting errors instead of aborting. But | ||
| 8 | if you load an image at a specific size, we also execute our | ||
| 9 | scaling code, which was not careful enough about overflow in some | ||
| 10 | places. | ||
| 11 | |||
| 12 | This commit makes the scaling code silently return if it fails to | ||
| 13 | allocate filter tables. This is the best we can do, since | ||
| 14 | gdk_pixbuf_scale() is not taking a GError. | ||
| 15 | |||
| 16 | https://bugzilla.gnome.org/show_bug.cgi?id=752297 | ||
| 17 | |||
| 18 | Upstream-Status: backport | ||
| 19 | |||
| 20 | Signed-off-by: Li Zhou <li.zhou@windriver.com> | ||
| 21 | --- | ||
| 22 | gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++----- | ||
| 23 | 1 file changed, 17 insertions(+), 5 deletions(-) | ||
| 24 | |||
| 25 | diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c | ||
| 26 | index 29a1c14..ce51745 100644 | ||
| 27 | --- a/gdk-pixbuf/pixops/pixops.c | ||
| 28 | +++ b/gdk-pixbuf/pixops/pixops.c | ||
| 29 | @@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter) | ||
| 30 | int i_offset, j_offset; | ||
| 31 | int n_x = filter->x.n; | ||
| 32 | int n_y = filter->y.n; | ||
| 33 | - int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y); | ||
| 34 | + gsize n_weights; | ||
| 35 | + int *weights; | ||
| 36 | + | ||
| 37 | + n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y; | ||
| 38 | + if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y) | ||
| 39 | + return NULL; /* overflow, bail */ | ||
| 40 | + | ||
| 41 | + weights = g_try_new (int, n_weights); | ||
| 42 | + if (!weights) | ||
| 43 | + return NULL; /* overflow, bail */ | ||
| 44 | |||
| 45 | for (i_offset=0; i_offset < SUBSAMPLE; i_offset++) | ||
| 46 | for (j_offset=0; j_offset < SUBSAMPLE; j_offset++) | ||
| 47 | @@ -1347,8 +1356,11 @@ pixops_process (guchar *dest_buf, | ||
| 48 | if (x_step == 0 || y_step == 0) | ||
| 49 | return; /* overflow, bail out */ | ||
| 50 | |||
| 51 | - line_bufs = g_new (guchar *, filter->y.n); | ||
| 52 | filter_weights = make_filter_table (filter); | ||
| 53 | + if (!filter_weights) | ||
| 54 | + return; /* overflow, bail out */ | ||
| 55 | + | ||
| 56 | + line_bufs = g_new (guchar *, filter->y.n); | ||
| 57 | |||
| 58 | check_shift = check_size ? get_check_shift (check_size) : 0; | ||
| 59 | |||
| 60 | @@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim, | ||
| 61 | double scale) | ||
| 62 | { | ||
| 63 | int n = ceil (1 / scale + 1); | ||
| 64 | - double *pixel_weights = g_new (double, SUBSAMPLE * n); | ||
| 65 | + double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); | ||
| 66 | int offset; | ||
| 67 | int i; | ||
| 68 | |||
| 69 | @@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension *dim, | ||
| 70 | } | ||
| 71 | |||
| 72 | dim->n = n; | ||
| 73 | - dim->weights = g_new (double, SUBSAMPLE * n); | ||
| 74 | + dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); | ||
| 75 | |||
| 76 | pixel_weights = dim->weights; | ||
| 77 | |||
| 78 | @@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim, | ||
| 79 | double scale) | ||
| 80 | { | ||
| 81 | int n = ceil (1/scale + 3.0); | ||
| 82 | - double *pixel_weights = g_new (double, SUBSAMPLE * n); | ||
| 83 | + double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); | ||
| 84 | double w; | ||
| 85 | int offset, i; | ||
| 86 | |||
| 87 | -- | ||
| 88 | 1.7.9.5 | ||
| 89 | |||
diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.32.1.bb index 68f3850fb7..6e3cb02b65 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.30.8.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.32.1.bb | |||
| @@ -17,11 +17,10 @@ SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \ | |||
| 17 | file://extending-libinstall-dependencies.patch \ | 17 | file://extending-libinstall-dependencies.patch \ |
| 18 | file://run-ptest \ | 18 | file://run-ptest \ |
| 19 | file://fatal-loader.patch \ | 19 | file://fatal-loader.patch \ |
| 20 | file://0001-pixops-Be-more-careful-about-integer-overflow.patch \ | ||
| 21 | " | 20 | " |
| 22 | 21 | ||
| 23 | SRC_URI[md5sum] = "4fed0d54432f1b69fc6e66e608bd5542" | 22 | SRC_URI[md5sum] = "b1590189a2e89fab9f871959c168508c" |
| 24 | SRC_URI[sha256sum] = "4853830616113db4435837992c0aebd94cbb993c44dc55063cee7f72a7bef8be" | 23 | SRC_URI[sha256sum] = "4432b74f25538c7d6bcb3ca51adabdd666168955f25812a2568dc9637697f3bc" |
| 25 | 24 | ||
| 26 | inherit autotools pkgconfig gettext pixbufcache ptest-gnome | 25 | inherit autotools pkgconfig gettext pixbufcache ptest-gnome |
| 27 | 26 | ||
