From f58c813f8afcd08acdd630f378cff1a5009655cc Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>

Date: Thu, 31 Jan 2019 16:02:19 +0000

Subject: [PATCH] merge in fixes for libgd CVE-2019-6978

---

 README                 |  5 +++++

 configure.ac           |  2 +-

 src/extra/gd/gd_jpeg.c | 21 +++++++++++++++++----

 src/extra/gd/gd_wbmp.c | 24 ++++++++++++++++++++++--

 4 files changed, 45 insertions(+), 7 deletions(-)

diff --git a/src/extra/gd/gd_jpeg.c b/src/extra/gd/gd_jpeg.c

index 7e6dfbb..b270186 100644

--- a/src/extra/gd/gd_jpeg.c

+++ b/src/extra/gd/gd_jpeg.c

@@ -72,6 +72,8 @@ fatal_jpeg_error (j_common_ptr cinfo)

   exit (99);

 }

+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality);

+

 /*

  * Write IM to OUTFILE as a JFIF-formatted JPEG image, using quality

  * QUALITY.  If QUALITY is in the range 0-100, increasing values

@@ -93,8 +95,12 @@ gdImageJpegPtr (gdImagePtr im, int *size, int quality)

 {

   void *rv;

   gdIOCtx *out = gdNewDynamicCtx (2048, NULL);

-  gdImageJpegCtx (im, out, quality);

-  rv = gdDPExtractData (out, size);

+  if (out == NULL) return NULL;

+  if (!_gdImageJpegCtx(im, out, quality)) {

+    rv = gdDPExtractData(out, size);

+  } else {

+    rv = NULL;

+  }

   out->free (out);

   return rv;

 }

@@ -103,6 +109,12 @@ static void jpeg_gdIOCtx_dest (j_compress_ptr cinfo, gdIOCtx * outfile);

 void

 gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)

+{

+  _gdImageJpegCtx(im, outfile, quality);

+}

+

+/* returns 0 on success, 1 on failure */

+static int _gdImageJpegCtx(gdImagePtr im, gdIOCtx *outfile, int quality)

 {

   struct jpeg_compress_struct cinfo;

   struct jpeg_error_mgr jerr;

@@ -139,7 +151,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)

       /* we're here courtesy of longjmp */

       if (row)

 	gdFree (row);

-      return;

+      return 1;

     }

   cinfo.err->error_exit = fatal_jpeg_error;

@@ -173,7 +185,7 @@ gdImageJpegCtx (gdImagePtr im, gdIOCtx * outfile, int quality)

       fprintf (stderr, "gd-jpeg: error: unable to allocate JPEG row "

 	       "structure: gdCalloc returns NULL\n");

       jpeg_destroy_compress (&cinfo);

-      return;

+      return 1;

     }

   rowptr[0] = row;

@@ -254,6 +266,7 @@ error:

 #endif

   jpeg_destroy_compress (&cinfo);

   gdFree (row);

+  return 0;

 }

 gdImagePtr

diff --git a/src/extra/gd/gd_wbmp.c b/src/extra/gd/gd_wbmp.c

index f1258da..4b27043 100644

--- a/src/extra/gd/gd_wbmp.c

+++ b/src/extra/gd/gd_wbmp.c

@@ -85,6 +85,7 @@ gd_getin (void *in)

   return (gdGetC ((gdIOCtx *) in));

 }

+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out);

 /*      gdImageWBMPCtx

    **  --------------

@@ -97,6 +98,12 @@ gd_getin (void *in)

  */

 void

 gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)

+{

+  _gdImageWBMPCtx(image, fg, out);

+}

+

+/* returns 0 on success, 1 on failure */

+static int _gdImageWBMPCtx(gdImagePtr image, int fg, gdIOCtx *out)

 {

   int x, y, pos;

@@ -105,7 +112,10 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)

   /* create the WBMP */

   if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL)

+    {

     fprintf (stderr, "Could not create WBMP\n");

+    return 1;

+    }

   /* fill up the WBMP structure */

   pos = 0;

@@ -123,9 +133,16 @@ gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)

   /* write the WBMP to a gd file descriptor */

   if (writewbmp (wbmp, &gd_putout, out))

+  {

     fprintf (stderr, "Could not save WBMP\n");

+    freewbmp (wbmp);

+    return 1;

+  }

+

   /* des submitted this bugfix: gdFree the memory. */

   freewbmp (wbmp);

+

+  return 0;

 }

@@ -211,8 +228,12 @@ gdImageWBMPPtr (gdImagePtr im, int *size, int fg)

 {

   void *rv;

   gdIOCtx *out = gdNewDynamicCtx (2048, NULL);

-  gdImageWBMPCtx (im, fg, out);

-  rv = gdDPExtractData (out, size);

+  if (out == NULL) return NULL;

+  if (!_gdImageWBMPCtx(im, fg, out)) {

+    rv = gdDPExtractData(out, size);

+  } else {

+    rv = NULL;

+  }

   out->free (out);

   return rv;

 }

-- 

2.20.1