mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-27 00:57:50 +00:00
Code Issues Releases Activity

In 16-bit samples case the starting offsets for the loops are calculated

Browse Source 
incorrectly which may cause a buffer overrun beyond the beginning of
the row buffer.

Submitted by:   Robert Nagy <robert@openbsd.org>
This commit is contained in:
Andrey A. Chernov 2004-07-07 10:33:28 +00:00
parent e5b315a539
commit 75ad4985f0
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=113128
2 changed files with 48 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
graphics/png/Makefile
View File

@ -6,8 +6,8 @@
#
PORTNAME= png
PORTVERSION= 1.2.5
PORTREVISION= 5
PORTVERSION= 1.2.5
PORTREVISION= 6
CATEGORIES= graphics
MASTER_SITES= http://www.libpng.org/pub/png/src/ \
ftp://swrinde.nde.swri.edu/pub/png/src/ \

46
graphics/png/files/patch-pngrtran.c Normal file
View File

@ -0,0 +1,46 @@
--- pngrtran.c.orig Tue Jul 6 17:44:30 2004
+++ pngrtran.c Tue Jul 6 17:46:22 2004
@@ -1889,8 +1889,8 @@ png_do_read_filler(png_row_infop row_inf
/* This changes the data from GG to GGXX */
if (flags & PNG_FLAG_FILLER_AFTER)
{
- png_bytep sp = row + (png_size_t)row_width;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 2;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 1; i < row_width; i++)
{
*(--dp) = hi_filler;
@@ -1907,8 +1907,8 @@ png_do_read_filler(png_row_infop row_inf
/* This changes the data from GG to XXGG */
else
{
- png_bytep sp = row + (png_size_t)row_width;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 2;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 0; i < row_width; i++)
{
*(--dp) = *(--sp);
@@ -1965,8 +1965,8 @@ png_do_read_filler(png_row_infop row_inf
/* This changes the data from RRGGBB to RRGGBBXX */
if (flags & PNG_FLAG_FILLER_AFTER)
{
- png_bytep sp = row + (png_size_t)row_width * 3;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 6;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 1; i < row_width; i++)
{
*(--dp) = hi_filler;
@@ -1987,8 +1987,8 @@ png_do_read_filler(png_row_infop row_inf
/* This changes the data from RRGGBB to XXRRGGBB */
else
{
- png_bytep sp = row + (png_size_t)row_width * 3;
- png_bytep dp = sp + (png_size_t)row_width;
+ png_bytep sp = row + (png_size_t)row_width * 6;
+ png_bytep dp = sp + (png_size_t)row_width * 2;
for (i = 0; i < row_width; i++)
{
*(--dp) = *(--sp);