mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-17 03:25:46 +00:00
1a3c3e5ae9
- fix double-free in in jas_iccattrval_destroy() Obtained from: RedHat Security: CVE-2014-8137 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1173157 - fix heap overflow in jp2_decode() Obtained from: RedHat Security: CVE-2014-8138 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1173162 - dec->numtiles off-by-one check in jpc_dec_process_sot() Obtained from: RedHat, Fedora Security: CVE-2014-8157 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1179282 - multiple stack-based buffer overflows Obtained from: RedHat, Fedora Security: CVE-2014-8158 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1179282 - fix Heap overflows in libjasper Obtained from: RedHat Security: CVE-2014-9029 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1167537 - fix Use-after-free (and double-free) Security: CVE-2015-5221 Security: http://www.openwall.com/lists/oss-security/2015/08/20/4 PR: 203504 - patch (rows_ NULL check) Obtained from: RedHat Security: CVE-2016-2089 Security: https://bugzilla.redhat.com/show_bug.cgi?id=1302636
85 lines
2.1 KiB
C
85 lines
2.1 KiB
C
--- src/libjasper/base/jas_seq.c.orig 2007-01-19 22:43:05.000000000 +0100
|
|
+++ src/libjasper/base/jas_seq.c 2016-02-20 13:59:01.014091000 +0100
|
|
@@ -114,7 +114,7 @@
|
|
matrix->datasize_ = numrows * numcols;
|
|
|
|
if (matrix->maxrows_ > 0) {
|
|
- if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
|
|
+ if (!(matrix->rows_ = jas_malloc2(matrix->maxrows_,
|
|
sizeof(jas_seqent_t *)))) {
|
|
jas_matrix_destroy(matrix);
|
|
return 0;
|
|
@@ -122,7 +122,7 @@
|
|
}
|
|
|
|
if (matrix->datasize_ > 0) {
|
|
- if (!(matrix->data_ = jas_malloc(matrix->datasize_ *
|
|
+ if (!(matrix->data_ = jas_malloc2(matrix->datasize_,
|
|
sizeof(jas_seqent_t)))) {
|
|
jas_matrix_destroy(matrix);
|
|
return 0;
|
|
@@ -220,7 +220,7 @@
|
|
mat0->numrows_ = r1 - r0 + 1;
|
|
mat0->numcols_ = c1 - c0 + 1;
|
|
mat0->maxrows_ = mat0->numrows_;
|
|
- mat0->rows_ = jas_malloc(mat0->maxrows_ * sizeof(jas_seqent_t *));
|
|
+ mat0->rows_ = jas_malloc2(mat0->maxrows_, sizeof(jas_seqent_t *));
|
|
for (i = 0; i < mat0->numrows_; ++i) {
|
|
mat0->rows_[i] = mat1->rows_[r0 + i] + c0;
|
|
}
|
|
@@ -262,6 +262,10 @@
|
|
int rowstep;
|
|
jas_seqent_t *data;
|
|
|
|
+ if (!matrix->rows_) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
rowstep = jas_matrix_rowstep(matrix);
|
|
for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
|
|
rowstart += rowstep) {
|
|
@@ -282,6 +286,10 @@
|
|
jas_seqent_t *data;
|
|
int rowstep;
|
|
|
|
+ if (!matrix->rows_) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
rowstep = jas_matrix_rowstep(matrix);
|
|
for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
|
|
rowstart += rowstep) {
|
|
@@ -306,6 +314,10 @@
|
|
int rowstep;
|
|
jas_seqent_t *data;
|
|
|
|
+ if (!matrix->rows_) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
assert(n >= 0);
|
|
rowstep = jas_matrix_rowstep(matrix);
|
|
for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
|
|
@@ -325,6 +337,10 @@
|
|
int rowstep;
|
|
jas_seqent_t *data;
|
|
|
|
+ if (!matrix->rows_) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
rowstep = jas_matrix_rowstep(matrix);
|
|
for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
|
|
rowstart += rowstep) {
|
|
@@ -367,6 +383,10 @@
|
|
int rowstep;
|
|
jas_seqent_t *data;
|
|
|
|
+ if (!matrix->rows_) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
rowstep = jas_matrix_rowstep(matrix);
|
|
for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
|
|
rowstart += rowstep) {
|