- security update
* CVE-2019-6978 [bsc#1123522]
+ gd-CVE-2019-6978.patch
OBS-URL: https://build.opensuse.org/package/show/graphics/gd?expand=0&rev=51
This commit is contained in:
Git OBS Bridge
parent
f5f15c76f8
commit
3efdffe692
187
gd-CVE-2019-6978.patch
Normal file
187
gd-CVE-2019-6978.patch
Normal file
@ -0,0 +1,187 @@
|
||||
Index: libgd-2.2.5/src/gd_gif_out.c
|
||||
===================================================================
|
||||
--- libgd-2.2.5.orig/src/gd_gif_out.c 2017-08-30 13:05:54.000000000 +0200
|
||||
+++ libgd-2.2.5/src/gd_gif_out.c 2019-01-31 09:47:44.703693790 +0100
|
||||
@@ -99,6 +99,7 @@ static void char_init(GifCtx *ctx);
|
||||
static void char_out(int c, GifCtx *ctx);
|
||||
static void flush_char(GifCtx *ctx);
|
||||
|
||||
+static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out);
|
||||
|
||||
|
||||
|
||||
@@ -131,8 +132,11 @@ BGD_DECLARE(void *) gdImageGifPtr(gdImag
|
||||
void *rv;
|
||||
gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
|
||||
if (out == NULL) return NULL;
|
||||
- gdImageGifCtx(im, out);
|
||||
- rv = gdDPExtractData(out, size);
|
||||
+ if (!_gdImageGifCtx(im, out)) {
|
||||
+ rv = gdDPExtractData(out, size);
|
||||
+ } else {
|
||||
+ rv = NULL;
|
||||
+ }
|
||||
out->gd_free(out);
|
||||
return rv;
|
||||
}
|
||||
@@ -221,6 +225,12 @@ BGD_DECLARE(void) gdImageGif(gdImagePtr
|
||||
*/
|
||||
BGD_DECLARE(void) gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
|
||||
{
|
||||
+ _gdImageGifCtx(im, out);
|
||||
+}
|
||||
+
|
||||
+/* returns 0 on success, 1 on failure */
|
||||
+static int _gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
|
||||
+{
|
||||
gdImagePtr pim = 0, tim = im;
|
||||
int interlace, BitsPerPixel;
|
||||
interlace = im->interlace;
|
||||
@@ -231,7 +241,7 @@ BGD_DECLARE(void) gdImageGifCtx(gdImageP
|
||||
based temporary image. */
|
||||
pim = gdImageCreatePaletteFromTrueColor(im, 1, 256);
|
||||
if(!pim) {
|
||||
- return;
|
||||
+ return 1;
|
||||
}
|
||||
tim = pim;
|
||||
}
|
||||
@@ -247,6 +257,8 @@ BGD_DECLARE(void) gdImageGifCtx(gdImageP
|
||||
/* Destroy palette based temporary image. */
|
||||
gdImageDestroy( pim);
|
||||
}
|
||||
+
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
|
||||
Index: libgd-2.2.5/src/gd_jpeg.c
|
||||
===================================================================
|
||||
--- libgd-2.2.5.orig/src/gd_jpeg.c 2017-08-30 13:05:54.000000000 +0200
|
||||
+++ libgd-2.2.5/src/gd_jpeg.c 2019-01-31 09:47:44.707693815 +0100
|
||||
@@ -123,6 +123,8 @@ static void fatal_jpeg_error(j_common_pt
|
||||
exit(99);
|
||||
}
|
||||
|
||||
+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);
|
||||
+
|
||||
/*
|
||||
* Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality
|
||||
* QUALITY. If QUALITY is in the range 0-100, increasing values
|
||||
@@ -237,8 +239,11 @@ BGD_DECLARE(void *) gdImageJpegPtr(gdIma
|
||||
void *rv;
|
||||
gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
|
||||
if (out == NULL) return NULL;
|
||||
- gdImageJpegCtx(im, out, quality);
|
||||
- rv = gdDPExtractData(out, size);
|
||||
+ if (!_gdImageJpegCtx(im, out, quality)) {
|
||||
+ rv = gdDPExtractData(out, size);
|
||||
+ } else {
|
||||
+ rv = NULL;
|
||||
+ }
|
||||
out->gd_free(out);
|
||||
return rv;
|
||||
}
|
||||
@@ -260,6 +265,12 @@ void jpeg_gdIOCtx_dest(j_compress_ptr ci
|
||||
*/
|
||||
BGD_DECLARE(void) gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
|
||||
{
|
||||
+ _gdImageJpegCtx(im, outfile, quality);
|
||||
+}
|
||||
+
|
||||
+/* returns 0 on success, 1 on failure */
|
||||
+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)
|
||||
+{
|
||||
struct jpeg_compress_struct cinfo;
|
||||
struct jpeg_error_mgr jerr;
|
||||
int i, j, jidx;
|
||||
@@ -293,7 +304,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage
|
||||
if(row) {
|
||||
gdFree(row);
|
||||
}
|
||||
- return;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
cinfo.err->emit_message = jpeg_emit_message;
|
||||
@@ -334,7 +345,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage
|
||||
if(row == 0) {
|
||||
gd_error("gd-jpeg: error: unable to allocate JPEG row structure: gdCalloc returns NULL\n");
|
||||
jpeg_destroy_compress(&cinfo);
|
||||
- return;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
rowptr[0] = row;
|
||||
@@ -411,6 +422,7 @@ BGD_DECLARE(void) gdImageJpegCtx(gdImage
|
||||
jpeg_finish_compress(&cinfo);
|
||||
jpeg_destroy_compress(&cinfo);
|
||||
gdFree(row);
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
|
||||
Index: libgd-2.2.5/src/gd_wbmp.c
|
||||
===================================================================
|
||||
--- libgd-2.2.5.orig/src/gd_wbmp.c 2017-08-30 13:05:54.000000000 +0200
|
||||
+++ libgd-2.2.5/src/gd_wbmp.c 2019-01-31 09:47:44.707693815 +0100
|
||||
@@ -88,6 +88,8 @@ int gd_getin(void *in)
|
||||
return (gdGetC((gdIOCtx *)in));
|
||||
}
|
||||
|
||||
+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);
|
||||
+
|
||||
/*
|
||||
Function: gdImageWBMPCtx
|
||||
|
||||
@@ -101,13 +103,19 @@ int gd_getin(void *in)
|
||||
*/
|
||||
BGD_DECLARE(void) gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
|
||||
{
|
||||
+ _gdImageWBMPCtx(image, fg, out);
|
||||
+}
|
||||
+
|
||||
+/* returns 0 on success, 1 on failure */
|
||||
+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)
|
||||
+{
|
||||
int x, y, pos;
|
||||
Wbmp *wbmp;
|
||||
|
||||
/* create the WBMP */
|
||||
if((wbmp = createwbmp(gdImageSX(image), gdImageSY(image), WBMP_WHITE)) == NULL) {
|
||||
gd_error("Could not create WBMP\n");
|
||||
- return;
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
/* fill up the WBMP structure */
|
||||
@@ -123,11 +131,15 @@ BGD_DECLARE(void) gdImageWBMPCtx(gdImage
|
||||
|
||||
/* write the WBMP to a gd file descriptor */
|
||||
if(writewbmp(wbmp, &gd_putout, out)) {
|
||||
+ freewbmp(wbmp);
|
||||
gd_error("Could not save WBMP\n");
|
||||
+ return 1;
|
||||
}
|
||||
|
||||
/* des submitted this bugfix: gdFree the memory. */
|
||||
freewbmp(wbmp);
|
||||
+
|
||||
+ return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -271,8 +283,11 @@ BGD_DECLARE(void *) gdImageWBMPPtr(gdIma
|
||||
void *rv;
|
||||
gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
|
||||
if (out == NULL) return NULL;
|
||||
- gdImageWBMPCtx(im, fg, out);
|
||||
- rv = gdDPExtractData(out, size);
|
||||
+ if (!_gdImageWBMPCtx(im, fg, out)) {
|
||||
+ rv = gdDPExtractData(out, size);
|
||||
+ } else {
|
||||
+ rv = NULL;
|
||||
+ }
|
||||
out->gd_free(out);
|
||||
return rv;
|
||||
}
|
||||
@ -1,3 +1,10 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Jan 31 11:23:17 UTC 2019 - Petr Gajdos <pgajdos@suse.com>
|
||||
|
||||
- security update
|
||||
* CVE-2019-6978 [bsc#1123522]
|
||||
+ gd-CVE-2019-6978.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Dec 13 16:24:15 UTC 2018 - meissner@suse.com
|
||||
|
||||
|
||||
6
gd.spec
6
gd.spec
@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package gd
|
||||
#
|
||||
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
|
||||
# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@ -12,7 +12,7 @@
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
||||
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
@ -36,6 +36,7 @@ Patch3: gd-aliasing.patch
|
||||
Patch4: gd-CVE-2018-5711.patch
|
||||
Patch5: libgd-config.patch
|
||||
Patch6: gd-CVE-2018-1000222.patch
|
||||
Patch7: gd-CVE-2019-6978.patch
|
||||
# needed for tests
|
||||
BuildRequires: dejavu
|
||||
BuildRequires: libjpeg-devel
|
||||
@ -86,6 +87,7 @@ the formats accepted for inline images by most browsers.
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
chmod 644 COPYING
|
||||
|
||||
%build
|
||||
|
||||
Loading…
Reference in New Issue
Block a user