[pkgsrc/trunk]: pkgsrc/graphics/gdk-pixbuf/patches Add fix for http://secunia...

[he <he%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/ee0067ff15d1
branches:  trunk
changeset: 604198:ee0067ff15d1
user:      he <he%pkgsrc.org@localhost>
date:      Fri May 25 08:31:35 2012 +0000

description:
Add fix for http://secunia.com/advisories/49125/, taken from
http://bugzilla-attachments.gnome.org/attachment.cgi?id=212053.

diffstat:

 graphics/gdk-pixbuf/patches/patch-ao |  35 +++++++++++++++++++++++++++++++++++
 1 files changed, 35 insertions(+), 0 deletions(-)

diffs (39 lines):

diff -r 8f161396f217 -r ee0067ff15d1 graphics/gdk-pixbuf/patches/patch-ao
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/graphics/gdk-pixbuf/patches/patch-ao      Fri May 25 08:31:35 2012 +0000
@@ -0,0 +1,35 @@
+$NetBSD: patch-ao,v 1.1 2012/05/25 08:31:35 he Exp $
+
+Add fix for http://secunia.com/advisories/49125/, taken from
+http://bugzilla-attachments.gnome.org/attachment.cgi?id=212053.
+
+--- gdk-pixbuf/io-xbm.c.orig   2001-01-21 04:13:40.000000000 +0000
++++ gdk-pixbuf/io-xbm.c
+@@ -177,10 +177,16 @@ read_bitmap_file_data (FILE *fstream,
+                               type++;
+                       }
+ 
+-                      if (!strcmp ("width", type))
++                      if (!strcmp ("width", type)) {
++                              if (value <= 0)
++                                      RETURN (FALSE);
+                               ww = (unsigned int) value;
+-                      if (!strcmp ("height", type))
++                      }
++                      if (!strcmp ("height", type)) {
++                              if (value <= 0)
++                                      RETURN (FALSE);
+                               hh = (unsigned int) value;
++                      }
+                       if (!strcmp ("hot", type)) {
+                               if (type-- == name_and_type
+                                   || type-- == name_and_type)
+@@ -221,6 +227,8 @@ read_bitmap_file_data (FILE *fstream,
+               bytes_per_line = (ww+7)/8 + padding;
+ 
+               size = bytes_per_line * hh;
++              if (size / bytes_per_line != hh) /* overflow */
++                      RETURN (FALSE);
+               bits = g_malloc (size);
+ 
+               if (version10p) {