← Back to branch summary

~ubuntu-branches/ubuntu/precise/tiff/precise-security

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2014-81xx-6.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-03-30 08:11:18 UTC
  • Revision ID: package-import@ubuntu.com-20150330081118-bvaoaii1act27voq
Tags: 3.9.5-2ubuntu1.7
* SECURITY UPDATE: Fix multiple security issues
  - debian/patches/CVE-2014-81xx-1.patch to CVE-2014-81xx-11.patch
  - debian/patches/CVE-2014-8128-5.patch
  - debian/patches/CVE-2014-9655-1.patch to CVE-2014-9655-3.patch
  - debian/patches/read_overrun.patch
  - debian/patches/CVE-2014-8130.patch
  - CVE-2014-8127 (partially)
  - CVE-2014-8128
  - CVE-2014-8129
  - CVE-2014-8130
  - CVE-2014-9330
  - CVE-2014-9655

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2014-81xx-6.patch
 
1
From 3206e0c752a62da1ae606867113ed3bf9bf73306 Mon Sep 17 00:00:00 2001
 
2
From: erouault <erouault>
 
3
Date: Sun, 21 Dec 2014 19:53:59 +0000
 
4
Subject: [PATCH] * tools/thumbnail.c: fix out-of-buffer write
 
5
 http://bugzilla.maptools.org/show_bug.cgi?id=2489 (CVE-2014-8128)
 
6
 
 
7
---
 
8
 ChangeLog         | 5 +++++
 
9
 tools/thumbnail.c | 8 +++++++-
 
10
 2 files changed, 12 insertions(+), 1 deletion(-)
 
11
 
 
12
Index: tiff-3.9.5/tools/thumbnail.c
 
13
===================================================================
 
14
--- tiff-3.9.5.orig/tools/thumbnail.c   2015-03-30 07:47:09.929107438 -0400
 
15
+++ tiff-3.9.5/tools/thumbnail.c        2015-03-30 07:47:09.929107438 -0400
 
16
@@ -548,7 +548,13 @@
 
17
            err -= limit;
 
18
            sy++;
 
19
            if (err >= limit)
 
20
-               rows[nrows++] = br + bpr*sy;
 
21
+               {
 
22
+                       /* We should perhaps error loudly, but I can't make sense of that */
 
23
+                       /* code... */
 
24
+                       if( nrows == 256 )
 
25
+                               break;
 
26
+                       rows[nrows++] = br + bpr*sy;
 
27
+               }
 
28
        }
 
29
        setrow(row, nrows, rows);
 
30
        row += tnw;