Blame SOURCES/autotrace-0.31.1-CVE-2019-19004.patch

ee1b6c
diff -urN autotrace-0.31.1.old/input-bmp.c autotrace-0.31.1/input-bmp.c
ee1b6c
--- autotrace-0.31.1.old/input-bmp.c	2021-04-30 15:03:16.264446518 +0530
ee1b6c
+++ autotrace-0.31.1/input-bmp.c	2021-04-30 15:06:14.682051209 +0530
ee1b6c
@@ -220,6 +220,13 @@
ee1b6c
    * word length (32 bits == 4 bytes)
ee1b6c
    */
ee1b6c
 
ee1b6c
+  unsigned long overflowTest = Bitmap_Head.biWidth * Bitmap_Head.biBitCnt;
ee1b6c
+  if (overflowTest / Bitmap_Head.biWidth != Bitmap_Head.biBitCnt) {
ee1b6c
+    LOG("Error reading BMP file header. Width is too large\n");
ee1b6c
+    at_exception_fatal(&exp, "Error reading BMP file header. Width is too large");
ee1b6c
+    goto cleanup;
ee1b6c
+  }
ee1b6c
+
ee1b6c
   rowbytes= ( (Bitmap_Head.biWidth * Bitmap_Head.biBitCnt - 1) / 32) * 4 + 4;  
ee1b6c
 
ee1b6c
 #ifdef DEBUG