diff --git a/fix-null-deref.patch b/fix-null-deref.patch deleted file mode 100644 index 8ba59c9..0000000 --- a/fix-null-deref.patch +++ /dev/null @@ -1,23 +0,0 @@ -From f1b8e6323a8fdd029847b7efd400d5fc2ac9aecc Mon Sep 17 00:00:00 2001 -From: Eddie Kohler -Date: Tue, 26 Sep 2017 08:46:13 -0700 -Subject: [PATCH] Don't release the uncompressed image if it's all there is. - -Fix #115, #116 issues reported by Zhao Liang, Huawei Weiran Labs. ---- - src/support.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/support.c b/src/support.c -index e48075c..7978974 100644 ---- a/src/support.c -+++ b/src/support.c -@@ -1405,7 +1405,7 @@ analyze_crop(int nmerger, Gt_Crop* crop, int compress_immediately) - } - - found_right: -- if (compress_immediately > 0) -+ if (compress_immediately > 0 && srci->compressed) - Gif_ReleaseUncompressedImage(srci); - } - diff --git a/fix_double-free.patch b/fix_double-free.patch deleted file mode 100644 index b99bf5e..0000000 --- a/fix_double-free.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 118a46090c50829dc543179019e6140e1235f909 Mon Sep 17 00:00:00 2001 -From: Eddie Kohler -Date: Sat, 2 Dec 2017 23:08:51 -0500 -Subject: [PATCH] gif_read: Set last_name = NULL unconditionally. - -With a non-malicious GIF, last_name is set to NULL when a name -extension is followed by an image. Reported in #117, via -Debian, via a KAIST fuzzing program. ---- - src/gifread.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/gifread.c b/src/gifread.c -index eec4e31..9c287dd 100644 ---- a/src/gifread.c -+++ b/src/gifread.c -@@ -900,6 +900,7 @@ read_gif(Gif_Reader *grr, int read_flags, - Gif_DeleteArray(gfc.suffix); - Gif_DeleteArray(gfc.length); - gfc.gfi = 0; -+ last_name = 0; - - if (gfs) - gfs->errors = gfc.errors[1]; diff --git a/fix_gifdiff_null-deref.patch b/fix_gifdiff_null-deref.patch deleted file mode 100644 index 8fdca1e..0000000 --- a/fix_gifdiff_null-deref.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 263cd4519f45bc6ecde74ee280eb1d68ee2de642 Mon Sep 17 00:00:00 2001 -From: Eddie Kohler -Date: Sat, 2 Dec 2017 23:10:30 -0500 -Subject: [PATCH] Two GIFs with zero images are the same. - -Another KAIST report; we null-dereferenced previously. ---- - src/gifdiff.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/src/gifdiff.c b/src/gifdiff.c -index 04721d8..40da3c1 100644 ---- a/src/gifdiff.c -+++ b/src/gifdiff.c -@@ -248,12 +248,6 @@ compare(Gif_Stream *s1, Gif_Stream *s2) - Gif_CalculateScreenSize(s1, 0); - Gif_CalculateScreenSize(s2, 0); - -- if (s1->nimages != s2->nimages -- && (s1->nimages == 0 || s2->nimages == 0)) { -- different("frame counts differ: <#%d >#%d", s1->nimages, s2->nimages); -- return DIFFERENT; -- } -- - if (s1->screen_width != s2->screen_width - || s1->screen_height != s2->screen_height) { - different("screen sizes differ: <%dx%d >%dx%d", s1->screen_width, -@@ -268,6 +262,14 @@ compare(Gif_Stream *s1, Gif_Stream *s2) - return DIFFERENT; - } - -+ if (s1->nimages == 0 || s2->nimages == 0) { -+ if (s1->nimages != s2->nimages) { -+ different("frame counts differ: <#%d >#%d", s1->nimages, s2->nimages); -+ return DIFFERENT; -+ } else -+ return SAME; -+ } -+ - /* Create arrays for the image data */ - screen_width = s1->screen_width; - screen_height = s1->screen_height; diff --git a/gifsicle-1.90.tar.gz b/gifsicle-1.90.tar.gz deleted file mode 100644 index e4b25be..0000000 --- a/gifsicle-1.90.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:2d73b096752d58fa604cea559199aa6f55b45a3ec833898f94ff7997d22b834d -size 571910 diff --git a/gifsicle-1.91.tar.gz b/gifsicle-1.91.tar.gz new file mode 100644 index 0000000..59886e5 --- /dev/null +++ b/gifsicle-1.91.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0a4ee602aa244cdcdd86a250a6b39c94d8343cf526b8fae862d8a0efc337a800 +size 571588 diff --git a/gifsicle.changes b/gifsicle.changes index bc48039..1e65ae9 100644 --- a/gifsicle.changes +++ b/gifsicle.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Fri Jan 5 23:01:51 UTC 2018 - manfred99@gmx.ch + +- drop patches fix_double-free.patch, fix_gifdiff_null-deref.patch + and fix-null-deref.patch +- upgrade to version 1.91: + * Several security bug fixes with malicious GIFs. + ------------------------------------------------------------------- Wed Jan 3 20:58:34 UTC 2018 - manfred99@gmx.ch diff --git a/gifsicle.spec b/gifsicle.spec index 034d263..f8a7476 100644 --- a/gifsicle.spec +++ b/gifsicle.spec @@ -17,19 +17,13 @@ Name: gifsicle -Version: 1.90 +Version: 1.91 Release: 0 Summary: Creating and editing GIF images and animations License: GPL-2.0 Group: Productivity/Graphics/Other Url: https://www.lcdf.org/gifsicle/ Source: https://www.lcdf.org/gifsicle/%{name}-%{version}.tar.gz -# PATCH-FIX-UPSTREAM fix-null-deref.patch -Patch0: fix-null-deref.patch -# PATCH-FIX-UPSTREAM fix_double-free.patch -Patch1: fix_double-free.patch -# PATCH-FIX-UPSTREAM fix_gifdiff_null-deref.patch -Patch2: fix_gifdiff_null-deref.patch Obsoletes: ungifsicle < %{version} Provides: ungifsicle = %{version} BuildRequires: pkgconfig(x11) @@ -56,9 +50,6 @@ appearance. %prep %setup -q -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 %build %configure