1 files changed, 48 insertions, 0 deletions
diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
new file mode 100644
index 0000000..ffb4378
--- /dev/null
+++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch
@@ -0,0 +1,48 @@
+--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c	2002-09-27 23:12:40.000000000 +0200
++++ gdk-pixbuf-0.22.0.patched/gdk-pixbuf/io-bmp.c	2005-03-30 01:33:06.000000000 +0200
+@@ -31,8 +31,6 @@
+ #include "gdk-pixbuf-private.h"
+ #include "gdk-pixbuf-io.h"
+ 
+-
+-
+ #if 0
+ /* If these structures were unpacked, they would define the two headers of the
+  * BMP file.  After them comes the palette, and then the image data.
+@@ -206,7 +204,7 @@
+ 
+ 	if (State == NULL)
+ 		return NULL;
+-
++ 	
+ 	while (feof(f) == 0) {
+ 		length = fread(membuf, 1, sizeof (membuf), f);
+ 		if (length > 0)
+@@ -245,11 +243,26 @@
+ static gboolean
+ grow_buffer (struct bmp_progressive_state *State)
+ {
+-  guchar *tmp = realloc (State->buff, State->BufferSize);
++  guchar *tmp;
++
++  if (State->BufferSize == 0) {
++#if 0
++    g_set_error (error,
++		 GDK_PIXBUF_ERROR,
++		 GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
++		 _("BMP image has bogus header data"));
++#endif
++    State->read_state = READ_STATE_ERROR;
++    return FALSE;
++  }
++
++  tmp = realloc (State->buff, State->BufferSize);
++
+   if (!tmp) {
+     State->read_state = READ_STATE_ERROR;
+     return FALSE;
+   }
++
+   State->buff = tmp;
+   return TRUE;
+ }