diff options
| author | Alex Dupre <ale@FreeBSD.org> | 2016-09-28 08:20:46 +0000 |
|---|---|---|
| committer | Alex Dupre <ale@FreeBSD.org> | 2016-09-28 08:20:46 +0000 |
| commit | b1e3ed17fd4cbd76dcadad4cd0c8840cb8ee0199 (patch) | |
| tree | eb8939b625e89016d3d0173af15ba70e5b9eec5e /graphics/php56-gd/files | |
| parent | Comment out PATCH_DEPENDS. (diff) | |
Fix integer overflow in gdImageWebpCtx and bump PORTREVISION.
PR: 213023
Submitted by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Notes
Notes:
svn path=/head/; revision=422858
Diffstat (limited to 'graphics/php56-gd/files')
| -rw-r--r-- | graphics/php56-gd/files/patch-config.m4 | 6 | ||||
| -rw-r--r-- | graphics/php56-gd/files/patch-libgd_gd_webp.c | 18 |
2 files changed, 21 insertions, 3 deletions
diff --git a/graphics/php56-gd/files/patch-config.m4 b/graphics/php56-gd/files/patch-config.m4 index 468b69287246..232e1e91a9f6 100644 --- a/graphics/php56-gd/files/patch-config.m4 +++ b/graphics/php56-gd/files/patch-config.m4 @@ -1,6 +1,6 @@ ---- config.m4.orig 2013-12-11 00:31:06.000000000 +0100 -+++ config.m4 2013-12-24 21:11:19.000000000 +0100 -@@ -233,7 +233,7 @@ +--- config.m4.orig 2016-09-15 23:02:50.000000000 +0200 ++++ config.m4 2016-09-28 10:10:26.335642000 +0200 +@@ -228,7 +228,7 @@ AC_DEFUN([PHP_GD_T1LIB],[ ],[ AC_MSG_ERROR([Problem with libt1.(a|so). Please check config.log for more information.]) ],[ diff --git a/graphics/php56-gd/files/patch-libgd_gd_webp.c b/graphics/php56-gd/files/patch-libgd_gd_webp.c new file mode 100644 index 000000000000..b0c1419e022b --- /dev/null +++ b/graphics/php56-gd/files/patch-libgd_gd_webp.c @@ -0,0 +1,18 @@ +--- libgd/gd_webp.c.orig 2016-09-28 10:07:06.092196000 +0200 ++++ libgd/gd_webp.c 2016-09-28 10:08:12.429030000 +0200 +@@ -180,6 +180,15 @@ void gdImageWebpCtx (gdImagePtr im, gdIO + /* Conversion to Y,U,V buffer */ + yuv_width = (width + 1) >> 1; + yuv_height = (height + 1) >> 1; ++ ++ if (overflow2(width, height)) { ++ return; ++ } ++ /* simplification possible, because WebP must not be larger than 16384**2 */ ++ if (overflow2(width * height, 2 * sizeof(unsigned char))) { ++ return; ++ } ++ + yuv_nbytes = width * height + 2 * yuv_width * yuv_height; + + if ((Y = (unsigned char *)gdCalloc(yuv_nbytes, sizeof(unsigned char))) == NULL) { |