Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.1:kernel-2.6.32
ghostscript-mini
ghostscript-CVE-2009-0792.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ghostscript-CVE-2009-0792.patch of Package ghostscript-mini
--- icclib/icc.c +++ icclib/icc.c 2009-05-13 17:25:37.561902246 +0200 @@ -2982,7 +2982,7 @@ static int icmCurve_lookup_fwd( rv |= 1; } ix = (int)floor(val); /* Coordinate */ - if (ix > (p->size-2)) + if (ix < 0 || ix > (p->size-2)) ix = (p->size-2); w = val - (double)ix; /* weight */ val = p->data[ix]; @@ -3004,6 +3004,11 @@ static int icmTable_setup_bwd( ) { int i; + if (size > INT_MAX - 2) + /* Although rt->size is unsigned long, the rt data + * structure uses int data types to store indices. */ + return 2; + rt->size = size; /* Stash pointers to these away */ rt->data = data; @@ -3022,7 +3027,7 @@ static int icmTable_setup_bwd( rt->qscale = (double)rt->rsize/(rt->rmax - rt->rmin); /* Scale factor to quantize to */ /* Initialize the reverse lookup structures, and get overall min/max */ - if ((rt->rlists = (int **) icp->al->calloc(icp->al, 1, rt->rsize * sizeof(int *))) == NULL) { + if ((rt->rlists = (int **) icp->al->calloc(icp->al, rt->rsize, sizeof(int *))) == NULL) { return 2; } @@ -3035,6 +3040,15 @@ static int icmTable_setup_bwd( int t; t = s; s = e; e = t; } + /* s and e should both be in the range [0,rt->rsize] + * now, but let's not rely on floating point + * calculations -- double-check. */ + if (s < 0) + s = 0; + if (e < 0) + e = 0; + if (s >= rt->rsize) + s = rt->rsize-1; if (e >= rt->rsize) e = rt->rsize-1; @@ -3053,6 +3067,9 @@ static int icmTable_setup_bwd( as = rt->rlists[j][0]; /* Allocate space for this list */ nf = rt->rlists[j][1]; /* Next free location in list */ if (nf >= as) { /* need to expand space */ + if (as > INT_MAX / 2 / sizeof (int)) + return 2; + as *= 2; rt->rlists[j] = (int *) icp->al->realloc(icp->al,rt->rlists[j], sizeof(int) * as); if (rt->rlists[j] == NULL) { @@ -3104,7 +3121,7 @@ static int icmTable_lookup_bwd( val = rsize_1; ix = (int)floor(val); /* Coordinate */ - if (ix > (rt->size-2)) + if (ix < 0 || ix > (rt->size-2)) ix = (rt->size-2); if (rt->rlists[ix] != NULL) { /* There is a list of fwd candidates */ /* For each candidate forward range */ @@ -3131,6 +3148,7 @@ static int icmTable_lookup_bwd( /* We have failed to find an exact value, so return the nearest value */ /* (This is slow !) */ val = fabs(ival - rt->data[0]); + /* rt->size is known to be < INT_MAX */ for (k = 0, i = 1; i < rt->size; i++) { double er; er = fabs(ival - rt->data[i]); @@ -3671,7 +3689,7 @@ static int icmData_allocate( if (p->size != p->_size) { if (p->data != NULL) icp->al->free(icp->al, p->data); - if ((p->data = (unsigned char *) icp->al->malloc(icp->al, p->size * sizeof(unsigned char))) == NULL) { + if ((p->data = (unsigned char *) icp->al->calloc(icp->al, p->size, sizeof(unsigned char))) == NULL) { sprintf(icp->err,"icmData_alloc: malloc() of icmData data failed"); return icp->errc = 2; } @@ -3887,7 +3905,7 @@ static int icmText_allocate( if (p->size != p->_size) { if (p->data != NULL) icp->al->free(icp->al, p->data); - if ((p->data = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) { + if ((p->data = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) { sprintf(icp->err,"icmText_alloc: malloc() of icmText data failed"); return icp->errc = 2; } @@ -4301,7 +4319,7 @@ double *in /* Input array[inputChan] */ rv |= 1; } ix = (int)floor(val); /* Grid coordinate */ - if (ix > (p->inputEnt-2)) + if (ix < 0 || ix > (p->inputEnt-2)) ix = (p->inputEnt-2); w = val - (double)ix; /* weight */ val = table[ix]; @@ -4360,7 +4378,7 @@ double *in /* Input array[outputChan] * rv |= 1; } x = (int)floor(val); /* Grid coordinate */ - if (x > clutPoints_2) + if (x < 0 || x > clutPoints_2) x = clutPoints_2; co[e] = val - (double)x; /* 1.0 - weight */ gp += x * p->dinc[e]; /* Add index offset for base of cube */ @@ -4433,7 +4451,7 @@ double *in /* Input array[outputChan] * rv |= 1; } x = (int)floor(val); /* Grid coordinate */ - if (x > clutPoints_2) + if (x < 0 || x > clutPoints_2) x = clutPoints_2; co[e] = val - (double)x; /* 1.0 - weight */ gp += x * p->dinc[e]; /* Add index offset for base of cube */ @@ -4506,7 +4524,7 @@ double *in /* Input array[outputChan] * rv |= 1; } ix = (int)floor(val); /* Grid coordinate */ - if (ix > (p->outputEnt-2)) + if (ix < 0 || ix > (p->outputEnt-2)) ix = (p->outputEnt-2); w = val - (double)ix; /* weight */ val = table[ix]; @@ -6714,7 +6732,7 @@ static int icmTextDescription_allocate( if (p->size != p->_size) { if (p->desc != NULL) icp->al->free(icp->al, p->desc); - if ((p->desc = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) { + if ((p->desc = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) { sprintf(icp->err,"icmTextDescription_alloc: malloc() of Ascii description failed"); return icp->errc = 2; } @@ -7888,7 +7906,7 @@ static int icmUcrBg_allocate( if (p->size != p->_size) { if (p->string != NULL) icp->al->free(icp->al, p->string); - if ((p->string = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) { + if ((p->string = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) { sprintf(icp->err,"icmUcrBg_allocate: malloc() of string data failed"); return icp->errc = 2; } @@ -8827,7 +8845,7 @@ static int icmCrdInfo_allocate( if (p->ppsize != p->_ppsize) { if (p->ppname != NULL) icp->al->free(icp->al, p->ppname); - if ((p->ppname = (char *) icp->al->malloc(icp->al, p->ppsize * sizeof(char))) == NULL) { + if ((p->ppname = (char *) icp->al->calloc(icp->al, p->ppsize, sizeof(char))) == NULL) { sprintf(icp->err,"icmCrdInfo_alloc: malloc() of string data failed"); return icp->errc = 2; } @@ -8837,7 +8855,7 @@ static int icmCrdInfo_allocate( if (p->crdsize[t] != p->_crdsize[t]) { if (p->crdname[t] != NULL) icp->al->free(icp->al, p->crdname[t]); - if ((p->crdname[t] = (char *) icp->al->malloc(icp->al, p->crdsize[t] * sizeof(char))) == NULL) { + if ((p->crdname[t] = (char *) icp->al->calloc(icp->al, p->crdsize[t], sizeof(char))) == NULL) { sprintf(icp->err,"icmCrdInfo_alloc: malloc() of CRD%d name string failed",t); return icp->errc = 2; } @@ -9642,7 +9660,7 @@ static int icc_write( if (p->errc) return p->errc; - if (p->count > (UINT_MAX - 4 - len) / 12) { + if (p->count > (UINT_MAX - 4) / 12) { sprintf(p->err,"icc_write: too many tags"); return p->errc = 1; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
