1 files changed, 70 insertions, 0 deletions
diff --git a/media-libs/gegl/files/gegl-0.2.0-cve-2012-4433-4757cdf7.patch b/media-libs/gegl/files/gegl-0.2.0-cve-2012-4433-4757cdf7.patch
new file mode 100644
index 000000000000..f78557f5772a
--- /dev/null
+++ b/media-libs/gegl/files/gegl-0.2.0-cve-2012-4433-4757cdf7.patch
@@ -0,0 +1,70 @@
+From 4757cdf73d3675478d645a3ec8250ba02168a230 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Tue, 16 Oct 2012 14:56:40 +0000
+Subject: ppm-load: CVE-2012-4433: add plausibility checks for header fields
+
+Refuse values that are non-decimal, negative or overflow the target
+type.
+---
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index 3d6bce7..465096d 100644
+--- a/operations/external/ppm-load.c
++++ b/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+ 
+ typedef enum {
+   PIXMAP_ASCII  = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+ 
+ typedef struct {
+ 	map_type   type;
+-	gint       width;
+-	gint       height;
++	glong      width;
++	glong      height;
+         gsize      numsamples; /* width * height * channels */
+         gsize      bpc;        /* bytes per channel */
+ 	guchar    *data;
+@@ -82,11 +83,33 @@ ppm_load_read_header(FILE       *fp,
+       }
+ 
+     /* Get Width and Height */
+-    img->width  = strtol (header,&ptr,0);
+-    img->height = atoi (ptr);
++    errno = 0;
++    img->width  = strtol (header,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading width: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: width is negative");
++        return FALSE;
++      }
++
++    img->height = strtol (ptr,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading height: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: height is negative");
++        return FALSE;
++      }
+ 
+     fgets (header,MAX_CHARS_IN_ROW,fp);
+-    maxval = strtol (header,&ptr,0);
++    maxval = strtol (header,&ptr,10);
+ 
+     if ((maxval != 255) && (maxval != 65535))
+       {
+--
+cgit v0.9.0.2