|
 |
88ec22 |
From f91c78960495efa04c7f12eeb916158d4bfbabc4 Mon Sep 17 00:00:00 2001
|
|
|
88ec22 |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
88ec22 |
Date: Mon, 13 Jul 2020 15:40:11 +0200
|
|
|
88ec22 |
Subject: [PATCH] CVE-2020-11538
|
|
|
88ec22 |
|
|
|
88ec22 |
---
|
|
|
88ec22 |
src/libImaging/SgiRleDecode.c | 8 ++++++--
|
|
|
88ec22 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
88ec22 |
|
|
|
88ec22 |
diff --git a/src/libImaging/SgiRleDecode.c b/src/libImaging/SgiRleDecode.c
|
|
|
88ec22 |
index 6367ae7..eb8fc84 100644
|
|
|
88ec22 |
--- a/src/libImaging/SgiRleDecode.c
|
|
|
88ec22 |
+++ b/src/libImaging/SgiRleDecode.c
|
|
|
88ec22 |
@@ -28,6 +28,7 @@ static void read4B(UINT32* dest, UINT8* buf)
|
|
|
88ec22 |
static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
|
|
88ec22 |
{
|
|
|
88ec22 |
UINT8 pixel, count;
|
|
|
88ec22 |
+ int x = 0;
|
|
|
88ec22 |
|
|
|
88ec22 |
for (;n > 0; n--)
|
|
|
88ec22 |
{
|
|
|
88ec22 |
@@ -37,9 +38,10 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
|
|
88ec22 |
count = pixel & RLE_MAX_RUN;
|
|
|
88ec22 |
if (!count)
|
|
|
88ec22 |
return count;
|
|
|
88ec22 |
- if (count > xsize) {
|
|
|
88ec22 |
+ if (x + count > xsize) {
|
|
|
88ec22 |
return -1;
|
|
|
88ec22 |
}
|
|
|
88ec22 |
+ x += count;
|
|
|
88ec22 |
if (pixel & RLE_COPY_FLAG) {
|
|
|
88ec22 |
while(count--) {
|
|
|
88ec22 |
*dest = *src++;
|
|
|
88ec22 |
@@ -63,6 +65,7 @@ static int expandrow2(UINT16* dest, UINT16* src, int n, int z, int xsize)
|
|
|
88ec22 |
{
|
|
|
88ec22 |
UINT8 pixel, count;
|
|
|
88ec22 |
|
|
|
88ec22 |
+ int x = 0;
|
|
|
88ec22 |
|
|
|
88ec22 |
for (;n > 0; n--)
|
|
|
88ec22 |
{
|
|
|
88ec22 |
@@ -73,9 +76,10 @@ static int expandrow2(UINT16* dest, UINT16* src, int n, int z, int xsize)
|
|
|
88ec22 |
count = pixel & RLE_MAX_RUN;
|
|
|
88ec22 |
if (!count)
|
|
|
88ec22 |
return count;
|
|
|
88ec22 |
- if (count > xsize) {
|
|
|
88ec22 |
+ if (x + count > xsize) {
|
|
|
88ec22 |
return -1;
|
|
|
88ec22 |
}
|
|
|
88ec22 |
+ x += count;
|
|
|
88ec22 |
if (pixel & RLE_COPY_FLAG) {
|
|
|
88ec22 |
while(count--) {
|
|
|
88ec22 |
*dest = *src++;
|
|
|
88ec22 |
--
|
|
|
88ec22 |
2.26.2
|
|
|
88ec22 |
|