Petr Gajdos
cd84a81a7d
- added patches fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file + djvulibre-CVE-2021-32490.patch fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file + djvulibre-CVE-2021-32491.patch fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file + djvulibre-CVE-2021-32492.patch fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file + djvulibre-CVE-2021-32493.patch OBS-URL: https://build.opensuse.org/package/show/graphics/djvulibre?expand=0&rev=38
21 lines
567 B
Diff
21 lines
567 B
Diff
--- a/libdjvu/GBitmap.cpp
|
|
+++ a/libdjvu/GBitmap.cpp
|
|
@@ -69,6 +69,7 @@
|
|
#include <stddef.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
+#include <climits>
|
|
|
|
// - Author: Leon Bottou, 05/1997
|
|
|
|
@@ -1284,6 +1285,8 @@ GBitmap::decode(unsigned char *runs)
|
|
// initialize pixel array
|
|
if (nrows==0 || ncolumns==0)
|
|
G_THROW( ERR_MSG("GBitmap.not_init") );
|
|
+ if (ncolumns > USHRT_MAX - border)
|
|
+ G_THROW("GBitmap: row size exceeds maximum (corrupted file?)");
|
|
bytes_per_row = ncolumns + border;
|
|
if (runs==0)
|
|
G_THROW( ERR_MSG("GBitmap.null_arg") );
|
|
|