rpms/ocaml-camlimages/F-10 camlimages-oversized-png-check-CVE-2009-2295.patch, NONE, 1.1 ocaml-camlimages.spec, 1.10, 1.11

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Author: rjones

Update of /cvs/pkgs/rpms/ocaml-camlimages/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1237

Modified Files:
	ocaml-camlimages.spec 
Added Files:
	camlimages-oversized-png-check-CVE-2009-2295.patch 
Log Message:
- ocaml-camlimages: PNG reader multiple integer overflows
  (CVE 2009-2295 / RHBZ#509531).


camlimages-oversized-png-check-CVE-2009-2295.patch:

--- NEW FILE camlimages-oversized-png-check-CVE-2009-2295.patch ---
--- camlimages-3.0.1/src/pngread.c	2007-01-18 10:29:57.000000000 +0000
+++ camlimages-3.0.1-oversized-png-checks/src/pngread.c	2009-07-03 14:19:42.000000000 +0100
@@ -26,6 +26,12 @@
 #define PNG_TAG_INDEX16 2
 #define PNG_TAG_INDEX4 3
 
+/* Test if x or y are negative, or if multiplying x * y would cause an
+ * arithmetic overflow.
+ */
+#define oversized(x, y)						\
+  ((x) < 0 || (y) < 0 || (x) * (y) < (x) || (x) * (y) < (y))
+
 value read_png_file_as_rgb24( name )
      value name;
 {
@@ -81,6 +87,9 @@
   png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
 	       &interlace_type, NULL, NULL);
 
+  if (oversized (width, height))
+    failwith ("png error: image contains oversized or bogus width and height");
+
   if ( color_type == PNG_COLOR_TYPE_GRAY ||
        color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) { 
     png_set_gray_to_rgb(png_ptr); 
@@ -102,6 +111,9 @@
 
   rowbytes = png_get_rowbytes(png_ptr, info_ptr);
 
+  if (oversized (rowbytes, height))
+    failwith ("png error: image contains oversized or bogus rowbytes and height");
+
   {
     int i;
     png_bytep *row_pointers;
@@ -235,6 +247,9 @@
   png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
 	       &interlace_type, NULL, NULL);
 
+  if (oversized (width, height))
+    failwith ("png error: image contains oversized or bogus width and height");
+
   if ( color_type == PNG_COLOR_TYPE_GRAY ||
        color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) { 
     png_set_gray_to_rgb(png_ptr); 
@@ -251,6 +266,9 @@
 
   rowbytes = png_get_rowbytes(png_ptr, info_ptr);
 
+  if (oversized (rowbytes, height))
+    failwith ("png error: image contains oversized or bogus rowbytes and height");
+
 /*
 fprintf(stderr, "pngread.c: actual loading\n"); fflush(stderr);
 */


Index: ocaml-camlimages.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-camlimages/F-10/ocaml-camlimages.spec,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -p -r1.10 -r1.11
--- ocaml-camlimages.spec	3 Nov 2008 18:10:10 -0000	1.10
+++ ocaml-camlimages.spec	3 Jul 2009 13:54:53 -0000	1.11
@@ -4,7 +4,7 @@
 
 Name:           ocaml-camlimages
 Version:        3.0.1
-Release:        3%{?dist}
+Release:        3%{?dist}.1
 Summary:        OCaml image processing library
 
 Group:          Development/Libraries
@@ -16,6 +16,9 @@ BuildRoot:      %{_tmppath}/%{name}-%{ve
 
 Patch0:         camlimages-3.0.1-display-module.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=509531#c4
+Patch1:         camlimages-oversized-png-check-CVE-2009-2295.patch
+
 BuildRequires:  ocaml >= 3.10.1
 BuildRequires:  ocaml-lablgtk-devel
 BuildRequires:  ocaml-x11
@@ -62,6 +65,7 @@ Includes documentation provided by ocaml
 # Gdk.Display submodule clashes with the Display module in
 # the examples/liv directory, so rename it:
 %patch0 -p1
+%patch1 -p1
 aclocal -I .
 automake
 autoconf
@@ -107,6 +111,10 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Fri Jul  3 2009 Richard W.M. Jones <rjones@xxxxxxxxxx> - 3.0.1-3.fc10.1
+- ocaml-camlimages: PNG reader multiple integer overflows
+  (CVE 2009-2295 / RHBZ#509531).
+
 * Mon Nov  3 2008 Richard W.M. Jones <rjones@xxxxxxxxxx> - 3.0.1-3
 - +BR gtk2-devel.
 - +BR ocaml-x11.

_______________________________________________
Fedora-ocaml-list mailing list
Fedora-ocaml-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-ocaml-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]

  Powered by Linux