diff options
| author | Dirk Meyer <dinoex@FreeBSD.org> | 2008-09-20 07:33:20 +0000 |
|---|---|---|
| committer | Dirk Meyer <dinoex@FreeBSD.org> | 2008-09-20 07:33:20 +0000 |
| commit | f025b838e67c696a3de58d6d7d1b4981cb2ffe43 (patch) | |
| tree | a3d4c336b5bc71be7bf030c374a5d83663476eb6 /graphics/tiff/files/patch-tif_pixarlog.c | |
| parent | - Update to 2.2.6 (diff) | |
- add Security patches
- fix missign macro in manpages
- add regression test
Security: CVE-2006-2193
Security: CVE-2006-2327
Security: CVE-2006-2656
Security: CVE-2006-3459
Security: CVE-2006-3460
Security: CVE-2006-3461
Security: CVE-2006-3462
Security: CVE-2006-3463
Security: CVE-2006-3464
Security: CVE-2006-3465
Security: CVE-2008-2327
PR: 127434
Submitted by: <bf2006a@yahoo.com>
Obtained From: Gentoo,Debian
Approved by: portmgr (marcus)
Diffstat (limited to 'graphics/tiff/files/patch-tif_pixarlog.c')
| -rw-r--r-- | graphics/tiff/files/patch-tif_pixarlog.c | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/graphics/tiff/files/patch-tif_pixarlog.c b/graphics/tiff/files/patch-tif_pixarlog.c new file mode 100644 index 000000000000..cf99c0c5b368 --- /dev/null +++ b/graphics/tiff/files/patch-tif_pixarlog.c @@ -0,0 +1,25 @@ +CVE-2006-3461 +=================================================================== +--- libtiff/tif_pixarlog.c.orig 2008-08-17 13:03:48.986994374 -0400 ++++ libtiff/tif_pixarlog.c 2008-08-17 13:03:52.894064968 -0400 +@@ -768,7 +768,19 @@ + if (tif->tif_flags & TIFF_SWAB) + TIFFSwabArrayOfShort(up, nsamples); + +- for (i = 0; i < nsamples; i += llen, up += llen) { ++ /* ++ * if llen is not an exact multiple of nsamples, the decode operation ++ * may overflow the output buffer, so truncate it enough to prevent that ++ * but still salvage as much data as possible. ++ * -- taviso@google.com 14th June 2006 ++ */ ++ if (nsamples % llen) ++ TIFFWarningExt(tif->tif_clientdata, module, ++ "%s: stride %lu is not a multiple of sample count, " ++ "%lu, data truncated.", tif->tif_name, llen, nsamples); ++ ++ ++ for (i = 0; i < nsamples - (nsamples % llen); i += llen, up += llen) { + switch (sp->user_datafmt) { + case PIXARLOGDATAFMT_FLOAT: + horizontalAccumulateF(up, llen, sp->stride, |