diff options
Diffstat (limited to 'media-libs/gdk-pixbuf/files')
5 files changed, 257 insertions, 0 deletions
diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch new file mode 100644 index 0000000..ffb4378 --- /dev/null +++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_reject_corrupt.patch @@ -0,0 +1,48 @@ +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2002-09-27 23:12:40.000000000 +0200 ++++ gdk-pixbuf-0.22.0.patched/gdk-pixbuf/io-bmp.c 2005-03-30 01:33:06.000000000 +0200 +@@ -31,8 +31,6 @@ + #include "gdk-pixbuf-private.h" + #include "gdk-pixbuf-io.h" + +- +- + #if 0 + /* If these structures were unpacked, they would define the two headers of the + * BMP file. After them comes the palette, and then the image data. +@@ -206,7 +204,7 @@ + + if (State == NULL) + return NULL; +- ++ + while (feof(f) == 0) { + length = fread(membuf, 1, sizeof (membuf), f); + if (length > 0) +@@ -245,11 +243,26 @@ + static gboolean + grow_buffer (struct bmp_progressive_state *State) + { +- guchar *tmp = realloc (State->buff, State->BufferSize); ++ guchar *tmp; ++ ++ if (State->BufferSize == 0) { ++#if 0 ++ g_set_error (error, ++ GDK_PIXBUF_ERROR, ++ GDK_PIXBUF_ERROR_CORRUPT_IMAGE, ++ _("BMP image has bogus header data")); ++#endif ++ State->read_state = READ_STATE_ERROR; ++ return FALSE; ++ } ++ ++ tmp = realloc (State->buff, State->BufferSize); ++ + if (!tmp) { + State->read_state = READ_STATE_ERROR; + return FALSE; + } ++ + State->buff = tmp; + return TRUE; + } diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_secure.patch b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_secure.patch new file mode 100644 index 0000000..29471f1 --- /dev/null +++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-bmp_secure.patch @@ -0,0 +1,19 @@ +Index: io-bmp.c +=================================================================== +RCS file: /cvs/gnome/gtk+/gdk-pixbuf/io-bmp.c,v +retrieving revision 1.41 +diff -u -p -r1.41 io-bmp.c +--- gdk-pixbuf/io-bmp.c 13 Aug 2004 02:26:57 -0000 1.41 ++++ gdk-pixbuf/io-bmp.c 20 Aug 2004 00:18:14 -0000 +@@ -876,8 +876,10 @@ DoCompressed(struct bmp_progressive_stat + guchar c; + gint idx; + +- if (context->compr.y >= context->Header.height) ++ if (context->compr.y >= context->Header.height) { ++ context->BufferDone = 0; + return TRUE; ++ } + + y = context->compr.y; + diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-loaders.patch b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-loaders.patch new file mode 100644 index 0000000..0686538 --- /dev/null +++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-loaders.patch @@ -0,0 +1,134 @@ +diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-ico.c 2002-09-27 17:19:15.000000000 -0500 ++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-ico.c 2005-10-27 11:28:23.000000000 -0500 +@@ -330,6 +330,9 @@ + + State->HeaderSize+=I; + ++ if (State->HeaderSize < 0) ++ return FALSE; ++ + if (State->HeaderSize>State->BytesInHeaderBuf) { + guchar *tmp=realloc(State->HeaderBuf,State->HeaderSize); + if (!tmp) +diff -NurdB gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-xpm.c 2001-03-01 15:16:28.000000000 -0500 ++++ gdk-pixbuf-0.22.0-patched/gdk-pixbuf/io-xpm.c 2005-10-27 11:29:14.000000000 -0500 +@@ -243,8 +243,8 @@ + break; + else { + if (numnames > 0) { +- space -= 1; +- strcat (color, " "); ++ strncat (color, " ", space); ++ space -= MIN (space, 1); + } + + strncat (color, temp, space); +@@ -281,7 +281,8 @@ + /* Fall through to the xpm_read_string. */ + + case op_body: +- xpm_read_string (h->infile, &h->buffer, &h->buffer_size); ++ if(!xpm_read_string (h->infile, &h->buffer, &h->buffer_size)) ++ return NULL; + return h->buffer; + + default: +@@ -317,13 +318,6 @@ + return NULL; + } + +-/* Destroy notification function for the pixbuf */ +-static void +-free_buffer (guchar *pixels, gpointer data) +-{ +- free (pixels); +-} +- + static gboolean + xpm_color_parse (const char *spec, XColor *color) + { +@@ -342,7 +336,8 @@ + gchar pixel_str[32]; + GHashTable *color_hash; + _XPMColor *colors, *color, *fallbackcolor; +- guchar *pixels, *pixtmp; ++ guchar *pixtmp; ++ GdkPixbuf* pixbuf; + + fallbackcolor = NULL; + +@@ -352,16 +347,33 @@ + return NULL; + } + sscanf (buffer, "%d %d %d %d", &w, &h, &n_col, &cpp); +- if (cpp >= 32) { +- g_warning ("XPM has more than 31 chars per pixel."); ++ if (cpp <= 0 || cpp >= 32) { ++ g_warning ("XPM has invalid number of chars per pixel."); + return NULL; + } ++ if (n_col <= 0 || ++ n_col >= G_MAXINT / (cpp + 1) || ++ n_col >= G_MAXINT / sizeof (_XPMColor)) { ++ g_warning ("XPM file has invalid number of colors"); ++ return NULL; ++ } + + /* The hash is used for fast lookups of color from chars */ + color_hash = g_hash_table_new (g_str_hash, g_str_equal); + +- name_buf = g_new (gchar, n_col * (cpp + 1)); +- colors = g_new (_XPMColor, n_col); ++ name_buf = g_new (gchar, n_col * (cpp + 1)); ++ if (!name_buf) { ++ g_warning ("Cannot allocate memory for loading XPM image"); ++ g_hash_table_destroy (color_hash); ++ return NULL; ++ } ++ colors = g_new (_XPMColor, n_col); ++ if (!colors) { ++ g_warning ("Cannot allocate memory for loading XPM image"); ++ g_hash_table_destroy (color_hash); ++ g_free (name_buf); ++ return NULL; ++ } + + for (cnt = 0; cnt < n_col; cnt++) { + gchar *color_name; +@@ -397,12 +409,8 @@ + fallbackcolor = color; + } + +- if (is_trans) +- pixels = malloc (w * h * 4); +- else +- pixels = malloc (w * h * 3); +- +- if (!pixels) { ++ pixbuf = gdk_pixbuf_new(GDK_COLORSPACE_RGB, is_trans, 8, w, h); ++ if (!pixbuf) { + g_hash_table_destroy (color_hash); + g_free (colors); + g_free (name_buf); +@@ -410,7 +418,7 @@ + } + + wbytes = w * cpp; +- pixtmp = pixels; ++ pixtmp = pixbuf->pixels; + + for (ycnt = 0; ycnt < h; ycnt++) { + buffer = (*get_buf) (op_body, handle); +@@ -443,9 +451,7 @@ + g_free (colors); + g_free (name_buf); + +- return gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, is_trans, 8, +- w, h, is_trans ? (w * 4) : (w * 3), +- free_buffer, NULL); ++ return pixbuf; + } + + /* Shared library entry point for file loading */ diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-m4.patch b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-m4.patch new file mode 100644 index 0000000..032976d --- /dev/null +++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-0.22.0-m4.patch @@ -0,0 +1,9 @@ +Fix aclocal warning: +/usr/share/aclocal/gdk-pixbuf.m4:12: warning: underquoted definition of AM_PATH_GDK_PIXBUF +--- gdk-pixbuf-0.22.0/gdk-pixbuf.m4 ++++ gdk-pixbuf-0.22.0/gdk-pixbuf.m4 +@@ -11,3 +11,3 @@ + dnl +-AC_DEFUN(AM_PATH_GDK_PIXBUF, ++AC_DEFUN([AM_PATH_GDK_PIXBUF], + [dnl diff --git a/media-libs/gdk-pixbuf/files/gdk-pixbuf-ds-png.diff b/media-libs/gdk-pixbuf/files/gdk-pixbuf-ds-png.diff new file mode 100644 index 0000000..39b4cb6 --- /dev/null +++ b/media-libs/gdk-pixbuf/files/gdk-pixbuf-ds-png.diff @@ -0,0 +1,47 @@ +diff -dPNur gdk-pixbuf-0.22.0/gdk-pixbuf/io-png.c gdk-pixbuf-0.22.0-png15/gdk-pixbuf/io-png.c +--- gdk-pixbuf-0.22.0/gdk-pixbuf/io-png.c 2001-01-24 21:59:23.000000000 +0100 ++++ gdk-pixbuf-0.22.0-png15/gdk-pixbuf/io-png.c 2012-11-16 14:32:15.000000000 +0100 +@@ -174,11 +174,12 @@ + png_destroy_read_struct (&png_ptr, &info_ptr, NULL); + return NULL; + } +- ++/* + if (setjmp (png_ptr->jmpbuf)) { + png_destroy_read_struct (&png_ptr, &info_ptr, &end_info); + return NULL; + } ++*/ + + png_init_io (png_ptr, f); + png_read_info (png_ptr, info_ptr); +@@ -311,12 +312,12 @@ + return NULL; + } + +- if (setjmp (lc->png_read_ptr->jmpbuf)) { ++/* if (setjmp (lc->png_read_ptr->jmpbuf)) { + if (lc->png_info_ptr) + png_destroy_read_struct(&lc->png_read_ptr, NULL, NULL); + g_free(lc); + return NULL; +- } ++ }*/ + + /* Create the auxiliary context struct */ + +@@ -366,11 +367,11 @@ + lc->max_row_seen_in_chunk = -1; + + /* Invokes our callbacks as needed */ +- if (setjmp (lc->png_read_ptr->jmpbuf)) { ++/* if (setjmp (lc->png_read_ptr->jmpbuf)) { + return FALSE; +- } else { ++ } else {*/ + png_process_data(lc->png_read_ptr, lc->png_info_ptr, buf, size); +- } ++/* }*/ + + if (lc->fatal_error_occurred) + return FALSE; |