CVS commit: pkgsrc/graphics/SDL_image

["Robert Bagdan" <kikadf%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   kikadf
Date:           Sat Oct  4 14:38:43 UTC 2025

Modified Files:
        pkgsrc/graphics/SDL_image: Makefile distinfo
Added Files:
        pkgsrc/graphics/SDL_image/patches: patch-IMG__xcf.c

Log Message:
graphics/SDL_image: fix CVE-2017-2887


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 pkgsrc/graphics/SDL_image/Makefile
cvs rdiff -u -r1.20 -r1.21 pkgsrc/graphics/SDL_image/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/graphics/SDL_image/patches/patch-IMG__xcf.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/SDL_image/Makefile
diff -u pkgsrc/graphics/SDL_image/Makefile:1.60 pkgsrc/graphics/SDL_image/Makefile:1.61
--- pkgsrc/graphics/SDL_image/Makefile:1.60     Sat Aug 30 22:45:14 2025
+++ pkgsrc/graphics/SDL_image/Makefile  Sat Oct  4 14:38:42 2025
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.60 2025/08/30 22:45:14 wiz Exp $
+# $NetBSD: Makefile,v 1.61 2025/10/04 14:38:42 kikadf Exp $
 
 DISTNAME=      SDL_image-1.2.12
-PKGREVISION=   15
+PKGREVISION=   16
 CATEGORIES=    graphics devel
 MASTER_SITES=  http://www.libsdl.org/projects/SDL_image/release/
 

Index: pkgsrc/graphics/SDL_image/distinfo
diff -u pkgsrc/graphics/SDL_image/distinfo:1.20 pkgsrc/graphics/SDL_image/distinfo:1.21
--- pkgsrc/graphics/SDL_image/distinfo:1.20     Tue Oct 26 10:45:58 2021
+++ pkgsrc/graphics/SDL_image/distinfo  Sat Oct  4 14:38:42 2025
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.20 2021/10/26 10:45:58 nia Exp $
+$NetBSD: distinfo,v 1.21 2025/10/04 14:38:42 kikadf Exp $
 
 BLAKE2s (SDL_image-1.2.12.tar.gz) = d1d1ec150eae5cf609082ca62fa8a77ba4f0973892df2b50c694bbce6c83f7d1
 SHA512 (SDL_image-1.2.12.tar.gz) = 0e71b280abc2a7f15755e4480a3c1b52d41f9f8b0c9216a6f5bd9fc0e939456fb5d6c10419e1d1904785783f9a1891ead278c03e88b0466fecc6871c3ca40136
@@ -6,5 +6,6 @@ Size (SDL_image-1.2.12.tar.gz) = 2231074
 SHA1 (patch-IMG__bmp.c) = 7c89a5bdcc5d3e5c1c7e2ee635dd063364bb8319
 SHA1 (patch-IMG__lbm.c) = 798ff3bc672894d4676214af97dbf30c3e639ffe
 SHA1 (patch-IMG__pcx.c) = 622c3c369b6830aa6b8093e58427555a16304576
+SHA1 (patch-IMG__xcf.c) = cdb4199b6bd701c35724609ba7abe4fc869fb866
 SHA1 (patch-IMG__xpm.c) = aab5f6949bc56f1087b3ff54eb763dd7a1aa1809
 SHA1 (patch-Makefile.in) = e8ae18e00af376676b292dc8419ed0d50c038db3

Added files:

Index: pkgsrc/graphics/SDL_image/patches/patch-IMG__xcf.c
diff -u /dev/null pkgsrc/graphics/SDL_image/patches/patch-IMG__xcf.c:1.1
--- /dev/null   Sat Oct  4 14:38:43 2025
+++ pkgsrc/graphics/SDL_image/patches/patch-IMG__xcf.c  Sat Oct  4 14:38:43 2025
@@ -0,0 +1,29 @@
+$NetBSD: patch-IMG__xcf.c,v 1.1 2025/10/04 14:38:43 kikadf Exp $
+
+* Fix CVE-2017-2887,
+  https://github.com/libsdl-org/SDL_image/commit/e7723676825cd2b2ffef3316ec1879d7726618f2
+
+--- IMG_xcf.c.orig     2025-10-04 14:31:21.599190567 +0000
++++ IMG_xcf.c
+@@ -251,6 +251,7 @@ static Uint32 Swap32 (Uint32 v) {
+ }
+ 
+ static void xcf_read_property (SDL_RWops * src, xcf_prop * prop) {
++  Uint32 len;
+   prop->id = SDL_ReadBE32 (src);
+   prop->length = SDL_ReadBE32 (src);
+ 
+@@ -274,7 +275,12 @@ static void xcf_read_property (SDL_RWops
+     break;
+   case PROP_COMPRESSION:
+   case PROP_COLOR:
+-    SDL_RWread (src, &prop->data, prop->length, 1);
++    if (prop->length > sizeof(prop->data)) {
++        len = sizeof(prop->data);
++    } else {
++        len = prop->length;
++    }
++    SDL_RWread(src, &prop->data, len, 1);
+     break;
+   case PROP_VISIBLE:
+     prop->data.visible = SDL_ReadBE32 (src);