diff options
| author | Mark H Weaver <mhw@netris.org> | 2016-07-28 13:47:25 -0400 |
|---|---|---|
| committer | Mark H Weaver <mhw@netris.org> | 2016-07-28 14:06:12 -0400 |
| commit | ae46cd0e4cfb1f06d099b2cda1f9e702e86c90e9 (patch) | |
| tree | 36da41904ffa05d4d568a9afccf2744a94c30e6c | |
| parent | 386b71d1b961a52201f64591076e51487a87bf0b (diff) | |
gnu: gd: Update to 2.2.3 [fixes CVE-2016-6207].
* gnu/packages/patches/gd-CVE-2016-5766.patch,
gnu/packages/patches/gd-CVE-2016-6128.patch,
gnu/packages/patches/gd-CVE-2016-6132.patch,
gnu/packages/patches/gd-CVE-2016-6214.patch,
gnu/packages/patches/gd-fix-test-on-i686.patch: Delete files.
* gnu/packages/patches/gd-fix-tests-on-i686.patch: New file.
* gnu/local.mk (dist_patch_DATA): Update accordingly.
* gnu/packages/gd.scm (gd): Update to 2.2.3.
[source]: Update patches field accordingly.
| -rw-r--r-- | gnu/local.mk | 6 | ||||
| -rw-r--r-- | gnu/packages/gd.scm | 10 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2016-5766.patch | 81 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2016-6128.patch | 253 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2016-6132.patch | 55 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-CVE-2016-6214.patch | 66 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-fix-test-on-i686.patch | 34 | ||||
| -rw-r--r-- | gnu/packages/patches/gd-fix-tests-on-i686.patch | 61 |
8 files changed, 65 insertions, 501 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index c143dd70a15..b0c4415f5bc 100644 --- a/gnu/local.mk +++ b/gnu/local.mk | |||
| @@ -512,11 +512,7 @@ dist_patch_DATA = \ | |||
| 512 | %D%/packages/patches/gcc-cross-environment-variables.patch \ | 512 | %D%/packages/patches/gcc-cross-environment-variables.patch \ |
| 513 | %D%/packages/patches/gcc-libvtv-runpath.patch \ | 513 | %D%/packages/patches/gcc-libvtv-runpath.patch \ |
| 514 | %D%/packages/patches/gcc-5.0-libvtv-runpath.patch \ | 514 | %D%/packages/patches/gcc-5.0-libvtv-runpath.patch \ |
| 515 | %D%/packages/patches/gd-CVE-2016-5766.patch \ | 515 | %D%/packages/patches/gd-fix-tests-on-i686.patch \ |
| 516 | %D%/packages/patches/gd-CVE-2016-6128.patch \ | ||
| 517 | %D%/packages/patches/gd-CVE-2016-6132.patch \ | ||
| 518 | %D%/packages/patches/gd-CVE-2016-6214.patch \ | ||
| 519 | %D%/packages/patches/gd-fix-test-on-i686.patch \ | ||
| 520 | %D%/packages/patches/gegl-CVE-2012-4433.patch \ | 516 | %D%/packages/patches/gegl-CVE-2012-4433.patch \ |
| 521 | %D%/packages/patches/geoclue-config.patch \ | 517 | %D%/packages/patches/geoclue-config.patch \ |
| 522 | %D%/packages/patches/ghostscript-CVE-2015-3228.patch \ | 518 | %D%/packages/patches/ghostscript-CVE-2015-3228.patch \ |
diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm index 3313ee68f22..153e1c7f8b6 100644 --- a/gnu/packages/gd.scm +++ b/gnu/packages/gd.scm | |||
| @@ -40,21 +40,17 @@ | |||
| 40 | ;; Note: With libgd.org now pointing to github.com, genuine old | 40 | ;; Note: With libgd.org now pointing to github.com, genuine old |
| 41 | ;; tarballs are no longer available. Notably, versions 2.0.x are | 41 | ;; tarballs are no longer available. Notably, versions 2.0.x are |
| 42 | ;; missing. | 42 | ;; missing. |
| 43 | (version "2.2.2") | 43 | (version "2.2.3") |
| 44 | 44 | ||
| 45 | (source (origin | 45 | (source (origin |
| 46 | (method url-fetch) | 46 | (method url-fetch) |
| 47 | (uri (string-append | 47 | (uri (string-append |
| 48 | "https://github.com/libgd/libgd/releases/download/gd-" | 48 | "https://github.com/libgd/libgd/releases/download/gd-" |
| 49 | version "/libgd-" version ".tar.xz")) | 49 | version "/libgd-" version ".tar.xz")) |
| 50 | (patches (search-patches "gd-fix-test-on-i686.patch" | ||
| 51 | "gd-CVE-2016-5766.patch" | ||
| 52 | "gd-CVE-2016-6128.patch" | ||
| 53 | "gd-CVE-2016-6132.patch" | ||
| 54 | "gd-CVE-2016-6214.patch")) | ||
| 55 | (sha256 | 50 | (sha256 |
| 56 | (base32 | 51 | (base32 |
| 57 | "1311g5mva2xlzqv3rjqjc4jjkn5lzls4skvr395h633zw1n7b7s8")))) | 52 | "0g3xz8jpz1pl2zzmssglrpa9nxiaa7rmcmvgpbrjz8k9cyynqsvl")) |
| 53 | (patches (search-patches "gd-fix-tests-on-i686.patch")))) | ||
| 58 | (build-system gnu-build-system) | 54 | (build-system gnu-build-system) |
| 59 | (native-inputs | 55 | (native-inputs |
| 60 | `(("pkg-config" ,pkg-config))) | 56 | `(("pkg-config" ,pkg-config))) |
diff --git a/gnu/packages/patches/gd-CVE-2016-5766.patch b/gnu/packages/patches/gd-CVE-2016-5766.patch deleted file mode 100644 index 400cb0ab480..00000000000 --- a/gnu/packages/patches/gd-CVE-2016-5766.patch +++ /dev/null | |||
| @@ -1,81 +0,0 @@ | |||
| 1 | Fix CVE-2016-5766 (Integer Overflow in _gd2GetHeader() resulting in heap | ||
| 2 | overflow). | ||
| 3 | |||
| 4 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5766 | ||
| 5 | |||
| 6 | Adapted from upstream commits: | ||
| 7 | https://github.com/libgd/libgd/commit/aba3db8ba159465ecec1089027a24835a6da9cc0 | ||
| 8 | https://github.com/libgd/libgd/commit/a6a0e7feabb2a9738086a5dc96348f233c87fa79 | ||
| 9 | |||
| 10 | Since `patch` cannot apply Git binary diffs, we omit the addition of | ||
| 11 | 'tests/gd2/php_bug_72339.c' and its associated binary data. | ||
| 12 | |||
| 13 | From aba3db8ba159465ecec1089027a24835a6da9cc0 Mon Sep 17 00:00:00 2001 | ||
| 14 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 15 | Date: Tue, 28 Jun 2016 16:23:42 +0700 | ||
| 16 | Subject: [PATCH] fix php bug 72339 (CVE-2016-5766), Integer Overflow in | ||
| 17 | _gd2GetHeader() resulting in heap overflow | ||
| 18 | |||
| 19 | --- | ||
| 20 | src/gd_gd2.c | 5 ++++- | ||
| 21 | tests/gd2/CMakeLists.txt | 1 + | ||
| 22 | tests/gd2/Makemodule.am | 6 ++++-- | ||
| 23 | tests/gd2/php_bug_72339.c | 21 +++++++++++++++++++++ | ||
| 24 | tests/gd2/php_bug_72339_exp.gd2 | Bin 0 -> 67108882 bytes | ||
| 25 | 5 files changed, 30 insertions(+), 3 deletions(-) | ||
| 26 | create mode 100644 tests/gd2/php_bug_72339.c | ||
| 27 | create mode 100644 tests/gd2/php_bug_72339_exp.gd2 | ||
| 28 | |||
| 29 | diff --git a/src/gd_gd2.c b/src/gd_gd2.c | ||
| 30 | index fd1e0c9..bdbbecf 100644 | ||
| 31 | --- a/src/gd_gd2.c | ||
| 32 | +++ b/src/gd_gd2.c | ||
| 33 | @@ -154,8 +154,11 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy, | ||
| 34 | nc = (*ncx) * (*ncy); | ||
| 35 | GD2_DBG (printf ("Reading %d chunk index entries\n", nc)); | ||
| 36 | sidx = sizeof (t_chunk_info) * nc; | ||
| 37 | + if (overflow2(sidx, nc)) { | ||
| 38 | + goto fail1; | ||
| 39 | + } | ||
| 40 | cidx = gdCalloc (sidx, 1); | ||
| 41 | - if (!cidx) { | ||
| 42 | + if (cidx == NULL) { | ||
| 43 | goto fail1; | ||
| 44 | } | ||
| 45 | for (i = 0; i < nc; i++) { | ||
| 46 | From a6a0e7feabb2a9738086a5dc96348f233c87fa79 Mon Sep 17 00:00:00 2001 | ||
| 47 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 48 | Date: Wed, 29 Jun 2016 09:36:26 +0700 | ||
| 49 | Subject: [PATCH] fix php bug 72339 (CVE-2016-5766), Integer Overflow in | ||
| 50 | _gd2GetHeader() resulting in heap overflow. Sync with php's sync | ||
| 51 | |||
| 52 | --- | ||
| 53 | src/gd_gd2.c | 7 ++++++- | ||
| 54 | tests/gd2/php_bug_72339.c | 2 +- | ||
| 55 | 2 files changed, 7 insertions(+), 2 deletions(-) | ||
| 56 | |||
| 57 | diff --git a/src/gd_gd2.c b/src/gd_gd2.c | ||
| 58 | index bdbbecf..2837456 100644 | ||
| 59 | --- a/src/gd_gd2.c | ||
| 60 | +++ b/src/gd_gd2.c | ||
| 61 | @@ -152,11 +152,16 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy, | ||
| 62 | |||
| 63 | if (gd2_compressed (*fmt)) { | ||
| 64 | nc = (*ncx) * (*ncy); | ||
| 65 | + | ||
| 66 | GD2_DBG (printf ("Reading %d chunk index entries\n", nc)); | ||
| 67 | + if (overflow2(sizeof(t_chunk_info), nc)) { | ||
| 68 | + goto fail1; | ||
| 69 | + } | ||
| 70 | sidx = sizeof (t_chunk_info) * nc; | ||
| 71 | - if (overflow2(sidx, nc)) { | ||
| 72 | + if (sidx <= 0) { | ||
| 73 | goto fail1; | ||
| 74 | } | ||
| 75 | + | ||
| 76 | cidx = gdCalloc (sidx, 1); | ||
| 77 | if (cidx == NULL) { | ||
| 78 | goto fail1; | ||
| 79 | -- | ||
| 80 | 2.9.1 | ||
| 81 | |||
diff --git a/gnu/packages/patches/gd-CVE-2016-6128.patch b/gnu/packages/patches/gd-CVE-2016-6128.patch deleted file mode 100644 index 45ee6b0cfa3..00000000000 --- a/gnu/packages/patches/gd-CVE-2016-6128.patch +++ /dev/null | |||
| @@ -1,253 +0,0 @@ | |||
| 1 | Fix CVE-2016-6128 (invalid color index is not properly handled leading | ||
| 2 | to denial of service). | ||
| 3 | |||
| 4 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6128 | ||
| 5 | |||
| 6 | Copied from upstream commits: | ||
| 7 | https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd | ||
| 8 | |||
| 9 | From 1ccfe21e14c4d18336f9da8515cd17db88c3de61 Mon Sep 17 00:00:00 2001 | ||
| 10 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 11 | Date: Mon, 27 Jun 2016 11:17:39 +0700 | ||
| 12 | Subject: [PATCH 1/8] fix php 72494, invalid color index not handled, can lead | ||
| 13 | to crash | ||
| 14 | |||
| 15 | --- | ||
| 16 | src/gd_crop.c | 4 ++++ | ||
| 17 | tests/CMakeLists.txt | 1 + | ||
| 18 | tests/Makefile.am | 1 + | ||
| 19 | 3 files changed, 6 insertions(+) | ||
| 20 | |||
| 21 | diff --git a/src/gd_crop.c b/src/gd_crop.c | ||
| 22 | index 0296633..532b49b 100644 | ||
| 23 | --- a/src/gd_crop.c | ||
| 24 | +++ b/src/gd_crop.c | ||
| 25 | @@ -136,6 +136,10 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c | ||
| 26 | return NULL; | ||
| 27 | } | ||
| 28 | |||
| 29 | + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) { | ||
| 30 | + return NULL; | ||
| 31 | + } | ||
| 32 | + | ||
| 33 | /* TODO: Add gdImageGetRowPtr and works with ptr at the row level | ||
| 34 | * for the true color and palette images | ||
| 35 | * new formats will simply work with ptr | ||
| 36 | diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt | ||
| 37 | index 6f5c786..5093d52 100644 | ||
| 38 | --- a/tests/CMakeLists.txt | ||
| 39 | +++ b/tests/CMakeLists.txt | ||
| 40 | @@ -31,6 +31,7 @@ if (BUILD_TEST) | ||
| 41 | gdimagecolortransparent | ||
| 42 | gdimagecopy | ||
| 43 | gdimagecopyrotated | ||
| 44 | + gdimagecrop | ||
| 45 | gdimagefile | ||
| 46 | gdimagefill | ||
| 47 | gdimagefilledellipse | ||
| 48 | diff --git a/tests/Makefile.am b/tests/Makefile.am | ||
| 49 | index 4f6e756..5a0ebe8 100644 | ||
| 50 | --- a/tests/Makefile.am | ||
| 51 | +++ b/tests/Makefile.am | ||
| 52 | @@ -25,6 +25,7 @@ include gdimagecolorresolve/Makemodule.am | ||
| 53 | include gdimagecolortransparent/Makemodule.am | ||
| 54 | include gdimagecopy/Makemodule.am | ||
| 55 | include gdimagecopyrotated/Makemodule.am | ||
| 56 | +include gdimagecrop/Makemodule.am | ||
| 57 | include gdimagefile/Makemodule.am | ||
| 58 | include gdimagefill/Makemodule.am | ||
| 59 | include gdimagefilledellipse/Makemodule.am | ||
| 60 | -- | ||
| 61 | 2.9.1 | ||
| 62 | |||
| 63 | From 8c9f39c7cb1f62ea00bc7a48aff64d3811c2d6d0 Mon Sep 17 00:00:00 2001 | ||
| 64 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 65 | Date: Mon, 27 Jun 2016 11:20:07 +0700 | ||
| 66 | Subject: [PATCH 2/8] fix php 72494, invalid color index not handled, can lead | ||
| 67 | to crash | ||
| 68 | |||
| 69 | --- | ||
| 70 | tests/gdimagecrop/.gitignore | 1 + | ||
| 71 | 1 file changed, 1 insertion(+) | ||
| 72 | create mode 100644 tests/gdimagecrop/.gitignore | ||
| 73 | |||
| 74 | diff --git a/tests/gdimagecrop/.gitignore b/tests/gdimagecrop/.gitignore | ||
| 75 | new file mode 100644 | ||
| 76 | index 0000000..8e8c9c3 | ||
| 77 | --- /dev/null | ||
| 78 | +++ b/tests/gdimagecrop/.gitignore | ||
| 79 | @@ -0,0 +1 @@ | ||
| 80 | +/php_bug_72494 | ||
| 81 | -- | ||
| 82 | 2.9.1 | ||
| 83 | |||
| 84 | From 8de370b7b6263a02268037a7cd13ddd991b43ea9 Mon Sep 17 00:00:00 2001 | ||
| 85 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 86 | Date: Mon, 27 Jun 2016 11:24:50 +0700 | ||
| 87 | Subject: [PATCH 3/8] fix php 72494, invalid color index not handled, can lead | ||
| 88 | to crash | ||
| 89 | |||
| 90 | --- | ||
| 91 | tests/gdimagecrop/CMakeLists.txt | 5 +++++ | ||
| 92 | 1 file changed, 5 insertions(+) | ||
| 93 | create mode 100644 tests/gdimagecrop/CMakeLists.txt | ||
| 94 | |||
| 95 | diff --git a/tests/gdimagecrop/CMakeLists.txt b/tests/gdimagecrop/CMakeLists.txt | ||
| 96 | new file mode 100644 | ||
| 97 | index 0000000..f7e4c7e | ||
| 98 | --- /dev/null | ||
| 99 | +++ b/tests/gdimagecrop/CMakeLists.txt | ||
| 100 | @@ -0,0 +1,5 @@ | ||
| 101 | +SET(TESTS_FILES | ||
| 102 | + php_bug_72494 | ||
| 103 | +) | ||
| 104 | + | ||
| 105 | +ADD_GD_TESTS() | ||
| 106 | -- | ||
| 107 | 2.9.1 | ||
| 108 | |||
| 109 | From bca12e4e11ecda8a0ea719472700ad5c2b36a0d6 Mon Sep 17 00:00:00 2001 | ||
| 110 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 111 | Date: Mon, 27 Jun 2016 11:25:12 +0700 | ||
| 112 | Subject: [PATCH 4/8] fix php 72494, invalid color index not handled, can lead | ||
| 113 | to crash | ||
| 114 | |||
| 115 | --- | ||
| 116 | tests/gdimagecrop/Makemodule.am | 5 +++++ | ||
| 117 | 1 file changed, 5 insertions(+) | ||
| 118 | create mode 100644 tests/gdimagecrop/Makemodule.am | ||
| 119 | |||
| 120 | diff --git a/tests/gdimagecrop/Makemodule.am b/tests/gdimagecrop/Makemodule.am | ||
| 121 | new file mode 100644 | ||
| 122 | index 0000000..210888b | ||
| 123 | --- /dev/null | ||
| 124 | +++ b/tests/gdimagecrop/Makemodule.am | ||
| 125 | @@ -0,0 +1,5 @@ | ||
| 126 | +libgd_test_programs += \ | ||
| 127 | + gdimagecrop/php_bug_72494 | ||
| 128 | + | ||
| 129 | +EXTRA_DIST += \ | ||
| 130 | + gdimagecrop/CMakeLists.txt | ||
| 131 | -- | ||
| 132 | 2.9.1 | ||
| 133 | |||
| 134 | From 6ff72ae40c7c20ece939afb362d98cc37f4a1c96 Mon Sep 17 00:00:00 2001 | ||
| 135 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 136 | Date: Mon, 27 Jun 2016 11:25:40 +0700 | ||
| 137 | Subject: [PATCH 5/8] fix php 72494, invalid color index not handled, can lead | ||
| 138 | to crash | ||
| 139 | |||
| 140 | --- | ||
| 141 | tests/gdimagecrop/php_bug_72494.c | 23 +++++++++++++++++++++++ | ||
| 142 | 1 file changed, 23 insertions(+) | ||
| 143 | create mode 100644 tests/gdimagecrop/php_bug_72494.c | ||
| 144 | |||
| 145 | diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c | ||
| 146 | new file mode 100644 | ||
| 147 | index 0000000..adaa379 | ||
| 148 | --- /dev/null | ||
| 149 | +++ b/tests/gdimagecrop/php_bug_72494.c | ||
| 150 | @@ -0,0 +1,23 @@ | ||
| 151 | +#include <stdio.h> | ||
| 152 | +#include <stdlib.h> | ||
| 153 | +#include "gd.h" | ||
| 154 | + | ||
| 155 | +#include "gdtest.h" | ||
| 156 | + | ||
| 157 | +int main() | ||
| 158 | +{ | ||
| 159 | + gdImagePtr im, exp; | ||
| 160 | + int error = 0; | ||
| 161 | + | ||
| 162 | + im = gdImageCreate(50, 50); | ||
| 163 | + | ||
| 164 | + if (!im) { | ||
| 165 | + gdTestErrorMsg("gdImageCreate failed.\n"); | ||
| 166 | + return 1; | ||
| 167 | + } | ||
| 168 | + | ||
| 169 | + gdImageCropThreshold(im, 1337, 0); | ||
| 170 | + gdImageDestroy(im); | ||
| 171 | + /* this bug tests a crash, it never reaches this point if the bug exists*/ | ||
| 172 | + return 0; | ||
| 173 | +} | ||
| 174 | -- | ||
| 175 | 2.9.1 | ||
| 176 | |||
| 177 | From a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa Mon Sep 17 00:00:00 2001 | ||
| 178 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 179 | Date: Mon, 27 Jun 2016 11:38:07 +0700 | ||
| 180 | Subject: [PATCH 6/8] fix php 72494, CID 149753, color is unsigned int, remove | ||
| 181 | useless <0 comparison | ||
| 182 | |||
| 183 | --- | ||
| 184 | src/gd_crop.c | 2 +- | ||
| 185 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 186 | |||
| 187 | diff --git a/src/gd_crop.c b/src/gd_crop.c | ||
| 188 | index 532b49b..d51ad67 100644 | ||
| 189 | --- a/src/gd_crop.c | ||
| 190 | +++ b/src/gd_crop.c | ||
| 191 | @@ -136,7 +136,7 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c | ||
| 192 | return NULL; | ||
| 193 | } | ||
| 194 | |||
| 195 | - if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) { | ||
| 196 | + if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) { | ||
| 197 | return NULL; | ||
| 198 | } | ||
| 199 | |||
| 200 | -- | ||
| 201 | 2.9.1 | ||
| 202 | |||
| 203 | From 907115fbb980862934d0de91af4977a216745039 Mon Sep 17 00:00:00 2001 | ||
| 204 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 205 | Date: Mon, 27 Jun 2016 11:51:40 +0700 | ||
| 206 | Subject: [PATCH 7/8] fix php 72494, CID 149753, color is unsigned int, remove | ||
| 207 | useless <0 comparison | ||
| 208 | |||
| 209 | --- | ||
| 210 | tests/gdimagecrop/php_bug_72494.c | 2 +- | ||
| 211 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 212 | |||
| 213 | diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c | ||
| 214 | index adaa379..5cb589b 100644 | ||
| 215 | --- a/tests/gdimagecrop/php_bug_72494.c | ||
| 216 | +++ b/tests/gdimagecrop/php_bug_72494.c | ||
| 217 | @@ -6,7 +6,7 @@ | ||
| 218 | |||
| 219 | int main() | ||
| 220 | { | ||
| 221 | - gdImagePtr im, exp; | ||
| 222 | + gdImagePtr im; | ||
| 223 | int error = 0; | ||
| 224 | |||
| 225 | im = gdImageCreate(50, 50); | ||
| 226 | -- | ||
| 227 | 2.9.1 | ||
| 228 | |||
| 229 | From fd623025505e87bba7ec8555eeb72dae4fb0afdc Mon Sep 17 00:00:00 2001 | ||
| 230 | From: Pierre Joye <pierre.php@gmail.com> | ||
| 231 | Date: Mon, 27 Jun 2016 12:04:25 +0700 | ||
| 232 | Subject: [PATCH 8/8] fix php 72494, CID 149753, color is unsigned int, remove | ||
| 233 | useless <0 comparison | ||
| 234 | |||
| 235 | --- | ||
| 236 | tests/gdimagecrop/php_bug_72494.c | 1 - | ||
| 237 | 1 file changed, 1 deletion(-) | ||
| 238 | |||
| 239 | diff --git a/tests/gdimagecrop/php_bug_72494.c b/tests/gdimagecrop/php_bug_72494.c | ||
| 240 | index 5cb589b..3bd19be 100644 | ||
| 241 | --- a/tests/gdimagecrop/php_bug_72494.c | ||
| 242 | +++ b/tests/gdimagecrop/php_bug_72494.c | ||
| 243 | @@ -7,7 +7,6 @@ | ||
| 244 | int main() | ||
| 245 | { | ||
| 246 | gdImagePtr im; | ||
| 247 | - int error = 0; | ||
| 248 | |||
| 249 | im = gdImageCreate(50, 50); | ||
| 250 | |||
| 251 | -- | ||
| 252 | 2.9.1 | ||
| 253 | |||
diff --git a/gnu/packages/patches/gd-CVE-2016-6132.patch b/gnu/packages/patches/gd-CVE-2016-6132.patch deleted file mode 100644 index 4c475b71b29..00000000000 --- a/gnu/packages/patches/gd-CVE-2016-6132.patch +++ /dev/null | |||
| @@ -1,55 +0,0 @@ | |||
| 1 | Fix CVE-2016-6132 (read out-of-bounds when parsing TGA files). | ||
| 2 | |||
| 3 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6132 | ||
| 4 | |||
| 5 | Copied from upstream commit: | ||
| 6 | https://github.com/libgd/libgd/commit/ead349e99868303b37f5e6e9d9d680c9dc71ff8d | ||
| 7 | |||
| 8 | From ead349e99868303b37f5e6e9d9d680c9dc71ff8d Mon Sep 17 00:00:00 2001 | ||
| 9 | From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org> | ||
| 10 | Date: Tue, 12 Jul 2016 11:24:09 +0200 | ||
| 11 | Subject: [PATCH] Fix #247, A read out-of-bands was found in the parsing of TGA | ||
| 12 | files (CVE-2016-6132) | ||
| 13 | |||
| 14 | --- | ||
| 15 | src/gd_tga.c | 13 +++++++++++-- | ||
| 16 | 1 file changed, 11 insertions(+), 2 deletions(-) | ||
| 17 | |||
| 18 | diff --git a/src/gd_tga.c b/src/gd_tga.c | ||
| 19 | index ef20f86..20fe2d2 100644 | ||
| 20 | --- a/src/gd_tga.c | ||
| 21 | +++ b/src/gd_tga.c | ||
| 22 | @@ -237,7 +237,11 @@ int read_image_tga( gdIOCtx *ctx, oTga *tga ) | ||
| 23 | return -1; | ||
| 24 | } | ||
| 25 | |||
| 26 | - gdGetBuf(conversion_buffer, image_block_size, ctx); | ||
| 27 | + if (gdGetBuf(conversion_buffer, image_block_size, ctx) != image_block_size) { | ||
| 28 | + gd_error("gd-tga: premature end of image data\n"); | ||
| 29 | + gdFree(conversion_buffer); | ||
| 30 | + return -1; | ||
| 31 | + } | ||
| 32 | |||
| 33 | while (buffer_caret < image_block_size) { | ||
| 34 | tga->bitmap[buffer_caret] = (int) conversion_buffer[buffer_caret]; | ||
| 35 | @@ -257,11 +261,16 @@ int read_image_tga( gdIOCtx *ctx, oTga *tga ) | ||
| 36 | } | ||
| 37 | conversion_buffer = (unsigned char *) gdMalloc(image_block_size * sizeof(unsigned char)); | ||
| 38 | if (conversion_buffer == NULL) { | ||
| 39 | + gd_error("gd-tga: premature end of image data\n"); | ||
| 40 | gdFree( decompression_buffer ); | ||
| 41 | return -1; | ||
| 42 | } | ||
| 43 | |||
| 44 | - gdGetBuf( conversion_buffer, image_block_size, ctx ); | ||
| 45 | + if (gdGetBuf(conversion_buffer, image_block_size, ctx) != image_block_size) { | ||
| 46 | + gdFree(conversion_buffer); | ||
| 47 | + gdFree(decompression_buffer); | ||
| 48 | + return -1; | ||
| 49 | + } | ||
| 50 | |||
| 51 | buffer_caret = 0; | ||
| 52 | |||
| 53 | -- | ||
| 54 | 2.9.1 | ||
| 55 | |||
diff --git a/gnu/packages/patches/gd-CVE-2016-6214.patch b/gnu/packages/patches/gd-CVE-2016-6214.patch deleted file mode 100644 index 7894a32bb11..00000000000 --- a/gnu/packages/patches/gd-CVE-2016-6214.patch +++ /dev/null | |||
| @@ -1,66 +0,0 @@ | |||
| 1 | Fix CVE-2016-6214 (read out-of-bounds when parsing TGA files). | ||
| 2 | |||
| 3 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6214 | ||
| 4 | |||
| 5 | Adapted from upstream commit: | ||
| 6 | https://github.com/libgd/libgd/commit/341aa68843ceceae9ba6e083431f14a07bd92308 | ||
| 7 | |||
| 8 | Since `patch` cannot apply Git binary diffs, we omit the addition of | ||
| 9 | 'tests/tga/bug00247a.c' and its associated binary data. | ||
| 10 | |||
| 11 | From 341aa68843ceceae9ba6e083431f14a07bd92308 Mon Sep 17 00:00:00 2001 | ||
| 12 | From: "Christoph M. Becker" <cmbecker69@gmx.de> | ||
| 13 | Date: Tue, 12 Jul 2016 19:23:13 +0200 | ||
| 14 | Subject: [PATCH] Unsupported TGA bpp/alphabit combinations should error | ||
| 15 | gracefully | ||
| 16 | |||
| 17 | Currently, only 24bpp without alphabits and 32bpp with 8 alphabits are | ||
| 18 | really supported. All other combinations will be rejected with a warning. | ||
| 19 | |||
| 20 | (cherry picked from commit cb1a0b7e54e9aa118270c23a4a6fe560e4590dc9) | ||
| 21 | --- | ||
| 22 | src/gd_tga.c | 16 ++++++---------- | ||
| 23 | tests/tga/.gitignore | 1 + | ||
| 24 | tests/tga/CMakeLists.txt | 1 + | ||
| 25 | tests/tga/Makemodule.am | 4 +++- | ||
| 26 | tests/tga/bug00247a.c | 19 +++++++++++++++++++ | ||
| 27 | tests/tga/bug00247a.tga | Bin 0 -> 36 bytes | ||
| 28 | 6 files changed, 30 insertions(+), 11 deletions(-) | ||
| 29 | create mode 100644 tests/tga/bug00247a.c | ||
| 30 | create mode 100644 tests/tga/bug00247a.tga | ||
| 31 | |||
| 32 | diff --git a/src/gd_tga.c b/src/gd_tga.c | ||
| 33 | index 20fe2d2..b4f8fa6 100644 | ||
| 34 | --- a/src/gd_tga.c | ||
| 35 | +++ b/src/gd_tga.c | ||
| 36 | @@ -99,7 +99,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromTgaCtx(gdIOCtx* ctx) | ||
| 37 | if (tga->bits == TGA_BPP_24) { | ||
| 38 | *tpix = gdTrueColor(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret]); | ||
| 39 | bitmap_caret += 3; | ||
| 40 | - } else if (tga->bits == TGA_BPP_32 || tga->alphabits) { | ||
| 41 | + } else if (tga->bits == TGA_BPP_32 && tga->alphabits) { | ||
| 42 | register int a = tga->bitmap[bitmap_caret + 3]; | ||
| 43 | |||
| 44 | *tpix = gdTrueColorAlpha(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret], gdAlphaMax - (a >> 1)); | ||
| 45 | @@ -159,16 +159,12 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga) | ||
| 46 | printf("wxh: %i %i\n", tga->width, tga->height); | ||
| 47 | #endif | ||
| 48 | |||
| 49 | - switch(tga->bits) { | ||
| 50 | - case 8: | ||
| 51 | - case 16: | ||
| 52 | - case 24: | ||
| 53 | - case 32: | ||
| 54 | - break; | ||
| 55 | - default: | ||
| 56 | - gd_error("bps %i not supported", tga->bits); | ||
| 57 | + if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0) | ||
| 58 | + || (tga->bits == TGA_BPP_32 && tga->alphabits == 8))) | ||
| 59 | + { | ||
| 60 | + gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n", | ||
| 61 | + tga->bits, tga->alphabits); | ||
| 62 | return -1; | ||
| 63 | - break; | ||
| 64 | } | ||
| 65 | |||
| 66 | tga->ident = NULL; | ||
diff --git a/gnu/packages/patches/gd-fix-test-on-i686.patch b/gnu/packages/patches/gd-fix-test-on-i686.patch deleted file mode 100644 index 6dd2e0fb032..00000000000 --- a/gnu/packages/patches/gd-fix-test-on-i686.patch +++ /dev/null | |||
| @@ -1,34 +0,0 @@ | |||
| 1 | Disable part of the gdimagerotate test on architectures such as i686 | ||
| 2 | where intermediate floating-point operations are done with 80-bit long | ||
| 3 | doubles, and typically later rounded to 64-bit doubles. This double | ||
| 4 | rounding causes small differences in the resulting pixel values | ||
| 5 | compared with other architectures, causing the image comparison to | ||
| 6 | fail. | ||
| 7 | |||
| 8 | Patch by Mark H Weaver <mhw@netris.org>. | ||
| 9 | |||
| 10 | --- libgd-2.2.2/tests/gdimagerotate/bug00067.c 1969-12-31 19:00:00.000000000 -0500 | ||
| 11 | +++ libgd-2.2.2/tests/gdimagerotate/bug00067.c 2016-07-18 12:19:19.885423132 -0400 | ||
| 12 | @@ -1,5 +1,6 @@ | ||
| 13 | #include <stdio.h> | ||
| 14 | #include <stdlib.h> | ||
| 15 | +#include <float.h> | ||
| 16 | #include "gd.h" | ||
| 17 | |||
| 18 | #include "gdtest.h" | ||
| 19 | @@ -41,6 +42,7 @@ | ||
| 20 | return 1; | ||
| 21 | } | ||
| 22 | |||
| 23 | +#if FLT_EVAL_METHOD != 2 | ||
| 24 | sprintf(filename, "bug00067_%03d_exp.png", angle); | ||
| 25 | path = gdTestFilePath2("gdimagerotate", filename); | ||
| 26 | if (!gdAssertImageEqualsToFile(path, exp)) { | ||
| 27 | @@ -48,6 +50,7 @@ | ||
| 28 | error += 1; | ||
| 29 | } | ||
| 30 | free(path); | ||
| 31 | +#endif | ||
| 32 | |||
| 33 | gdImageDestroy(exp); | ||
| 34 | } | ||
diff --git a/gnu/packages/patches/gd-fix-tests-on-i686.patch b/gnu/packages/patches/gd-fix-tests-on-i686.patch new file mode 100644 index 00000000000..8db64e6aaff --- /dev/null +++ b/gnu/packages/patches/gd-fix-tests-on-i686.patch | |||
| @@ -0,0 +1,61 @@ | |||
| 1 | Disable some image comparison tests on architectures such as i686 | ||
| 2 | where intermediate floating-point operations are done with 80-bit long | ||
| 3 | doubles, and typically later rounded to 64-bit doubles. This double | ||
| 4 | rounding causes small differences in the resulting pixel values | ||
| 5 | compared with other architectures, causing the image comparisons to | ||
| 6 | fail. | ||
| 7 | |||
| 8 | Patch by Mark H Weaver <mhw@netris.org>. | ||
| 9 | |||
| 10 | --- libgd-2.2.3/tests/gdimagerotate/bug00067.c 2016-06-18 05:42:16.000000000 -0400 | ||
| 11 | +++ libgd-2.2.3/tests/gdimagerotate/bug00067.c 2016-07-28 13:43:48.470767178 -0400 | ||
| 12 | @@ -1,5 +1,6 @@ | ||
| 13 | #include <stdio.h> | ||
| 14 | #include <stdlib.h> | ||
| 15 | +#include <float.h> | ||
| 16 | #include "gd.h" | ||
| 17 | |||
| 18 | #include "gdtest.h" | ||
| 19 | @@ -43,7 +44,7 @@ | ||
| 20 | |||
| 21 | sprintf(filename, "bug00067_%03d_exp.png", angle); | ||
| 22 | path = gdTestFilePath2("gdimagerotate", filename); | ||
| 23 | - if (!gdAssertImageEqualsToFile(path, exp)) { | ||
| 24 | + if (FLT_EVAL_METHOD != 2 && !gdAssertImageEqualsToFile(path, exp)) { | ||
| 25 | gdTestErrorMsg("comparing rotated image to %s failed.\n", path); | ||
| 26 | error += 1; | ||
| 27 | } | ||
| 28 | --- libgd-2.2.3/tests/gdimagecopyresampled/bug00201.c 2016-07-21 04:06:42.000000000 -0400 | ||
| 29 | +++ libgd-2.2.3/tests/gdimagecopyresampled/bug00201.c 2016-07-28 13:56:46.021447064 -0400 | ||
| 30 | @@ -1,3 +1,4 @@ | ||
| 31 | +#include <float.h> | ||
| 32 | #include "gd.h" | ||
| 33 | #include "gdtest.h" | ||
| 34 | |||
| 35 | @@ -65,7 +66,7 @@ | ||
| 36 | gdImageDestroy(background); | ||
| 37 | gdImageDestroy(scaled_logo); | ||
| 38 | |||
| 39 | - gdAssertImageEqualsToFile("gdimagecopyresampled/bug00201_exp.png", img); | ||
| 40 | + FLT_EVAL_METHOD != 2 && gdAssertImageEqualsToFile("gdimagecopyresampled/bug00201_exp.png", img); | ||
| 41 | gdImageDestroy(img); | ||
| 42 | return gdNumFailures(); | ||
| 43 | } | ||
| 44 | --- libgd-2.2.3/tests/gdimagecopyresampled/basic_alpha.c 2016-07-21 04:06:42.000000000 -0400 | ||
| 45 | +++ libgd-2.2.3/tests/gdimagecopyresampled/basic_alpha.c 2016-07-28 13:57:18.857831608 -0400 | ||
| 46 | @@ -1,5 +1,6 @@ | ||
| 47 | /* Testing basic gdImageCopyResampled() functionality with alpha channel */ | ||
| 48 | |||
| 49 | +#include <float.h> | ||
| 50 | #include "gd.h" | ||
| 51 | #include "gdtest.h" | ||
| 52 | |||
| 53 | @@ -33,7 +34,7 @@ | ||
| 54 | gdImageCopyResampled(copy, im, 0,0, 0,0, 200,200, 400,300); | ||
| 55 | gdImageDestroy(im); | ||
| 56 | |||
| 57 | - gdAssertImageEqualsToFile("gdimagecopyresampled/basic_alpha_exp.png", copy); | ||
| 58 | + FLT_EVAL_METHOD != 2 && gdAssertImageEqualsToFile("gdimagecopyresampled/basic_alpha_exp.png", copy); | ||
| 59 | |||
| 60 | gdImageDestroy(copy); | ||
| 61 | return gdNumFailures(); | ||
