forked from pool/libXpm
Stefan Dirsch
1510a4ef3e
* needed by U_0005-Fix-CVE-2022-4883-compression-commands-depend-on-PAT.patch
- U_0002-Fix-CVE-2022-46285-Infinite-loop-on-unclosed-comment.patch
* libXpm: Infinite loop on unclosed comments (CVE-2022-46285,
bsc#1207029)
- U_0004-Fix-CVE-2022-44617-Runaway-loop-with-width-of-0-and-.patch
* libXpm: Runaway loop on width of 0 and enormous height
(CVE-2022-44617, bsc#1207030)
- U_0005-Fix-CVE-2022-4883-compression-commands-depend-on-PAT.patch
* libXpm: compression commands depend on $PATH (CVE-2022-4883,
bsc#1207031)
- U_regression-bug1207029_1207030_1207031.patch
* regression fix for above patches
- U_regression2-bug1207029_1207030_1207031.patch
* second regression fix: Use gzip -d instead of gunzip
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/libXpm?expand=0&rev=18
25 lines
760 B
Diff
25 lines
760 B
Diff
@@ -, +, @@
|
|
---
|
|
src/create.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
--- a/src/create.c
|
|
+++ a/src/create.c
|
|
@@ -994,11 +994,15 @@ CreateXImage(
|
|
#if !defined(FOR_MSW) && !defined(AMIGA)
|
|
if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
|
|
XDestroyImage(*image_return);
|
|
+ *image_return = NULL;
|
|
return XpmNoMemory;
|
|
}
|
|
/* now that bytes_per_line must have been set properly alloc data */
|
|
- if((*image_return)->bytes_per_line == 0 || height == 0)
|
|
+ if((*image_return)->bytes_per_line == 0 || height == 0) {
|
|
+ XDestroyImage(*image_return);
|
|
+ *image_return = NULL;
|
|
return XpmNoMemory;
|
|
+ }
|
|
(*image_return)->data =
|
|
(char *) XpmMalloc((*image_return)->bytes_per_line * height);
|
|
|
|
--
|