|
 |
0653792 |
diff -up xmms-1.2.11-20071117cvs/xmms/bmp.c.CVE-2007-0653 xmms-1.2.11-20071117cvs/xmms/bmp.c
|
|
|
0653792 |
--- xmms-1.2.11-20071117cvs/xmms/bmp.c.CVE-2007-0653 2006-07-10 17:45:11.000000000 -0400
|
|
|
0653792 |
+++ xmms-1.2.11-20071117cvs/xmms/bmp.c 2011-07-14 15:54:02.497834489 -0400
|
|
|
0653792 |
@@ -19,6 +19,12 @@
|
|
|
0653792 |
*/
|
|
|
0653792 |
#include "xmms.h"
|
|
|
0653792 |
|
|
|
0653792 |
+#if HAVE_STDINT_H
|
|
|
0653792 |
+#include <stdint.h>
|
|
|
0653792 |
+#elif !defined(UINT32_MAX)
|
|
|
0653792 |
+#define UINT32_MAX 0xffffffffU
|
|
|
0653792 |
+#endif
|
|
|
0653792 |
+
|
|
|
0653792 |
struct rgb_quad
|
|
|
0653792 |
{
|
|
|
0653792 |
guchar rgbBlue;
|
|
|
0653792 |
@@ -183,7 +189,7 @@ GdkPixmap *read_bmp(gchar * filename)
|
|
|
0653792 |
}
|
|
|
0653792 |
else if (bitcount != 24 && bitcount != 16 && bitcount != 32)
|
|
|
0653792 |
{
|
|
|
0653792 |
- gint ncols, i;
|
|
|
0653792 |
+ guint32 ncols, i;
|
|
|
0653792 |
|
|
|
0653792 |
ncols = offset - headSize - 14;
|
|
|
0653792 |
if (headSize == 12)
|
|
|
0653792 |
@@ -201,9 +207,17 @@ GdkPixmap *read_bmp(gchar * filename)
|
|
|
0653792 |
}
|
|
|
0653792 |
}
|
|
|
0653792 |
fseek(file, offset, SEEK_SET);
|
|
|
0653792 |
+ /* verify buffer size */
|
|
|
0653792 |
+ if (!h || !w ||
|
|
|
0653792 |
+ w > (((UINT32_MAX - 3) / 3) / h) ||
|
|
|
0653792 |
+ h > (((UINT32_MAX - 3) / 3) / w)) {
|
|
|
0653792 |
+ g_warning("read_bmp(): width(%u)*height(%u) too large", w, h);
|
|
|
0653792 |
+ fclose(file);
|
|
|
0653792 |
+ return NULL;
|
|
|
0653792 |
+ }
|
|
|
0653792 |
+ data = g_malloc0((w * 3 * h) + 3); /* +3 is just for safety */
|
|
|
0653792 |
buffer = g_malloc(imgsize);
|
|
|
0653792 |
fread(buffer, imgsize, 1, file);
|
|
|
0653792 |
- data = g_malloc0((w * 3 * h) + 3); /* +3 is just for safety */
|
|
|
0653792 |
|
|
|
0653792 |
if (bitcount == 1)
|
|
|
0653792 |
read_1b_rgb(buffer, imgsize, data, w, h, rgb_quads);
|