head 1.10; access; symbols OPENPKG_E1_MP_HEAD:1.9 OPENPKG_E1_MP:1.9 OPENPKG_E1_MP_2_STABLE:1.9 OPENPKG_E1_FP:1.9 OPENPKG_2_STABLE_MP:1.9 OPENPKG_2_STABLE_20061018:1.9 OPENPKG_2_STABLE_20060622:1.9 OPENPKG_2_STABLE:1.9.0.4 OPENPKG_2_STABLE_BP:1.9 OPENPKG_2_5_RELEASE:1.9 OPENPKG_2_5_SOLID:1.9.0.2 OPENPKG_2_5_SOLID_BP:1.9 OPENPKG_2_4_RELEASE:1.8 OPENPKG_2_4_SOLID:1.8.0.2 OPENPKG_2_4_SOLID_BP:1.8 OPENPKG_CW_FP:1.8 OPENPKG_2_3_RELEASE:1.7 OPENPKG_2_3_SOLID:1.7.0.2 OPENPKG_2_3_SOLID_BP:1.7 OPENPKG_2_2_RELEASE:1.4 OPENPKG_2_2_SOLID:1.4.0.4 OPENPKG_2_2_SOLID_BP:1.4 OPENPKG_2_1_RELEASE:1.4 OPENPKG_2_1_SOLID:1.4.0.2 OPENPKG_2_1_SOLID_BP:1.4 OPENPKG_2_0_RELEASE:1.2 OPENPKG_2_0_SOLID:1.2.0.2 OPENPKG_2_0_SOLID_BP:1.2 OPENPKG_1_3_RELEASE:1.1.4.1 OPENPKG_1_3_SOLID:1.1.4.1.0.2 OPENPKG_1_3_SOLID_BP:1.1.4.1 OPENPKG_1_2_RELEASE:1.1 OPENPKG_1_2_SOLID:1.1.0.6 OPENPKG_1_2_SOLID_BP:1.1 OPENPKG_1_STABLE:1.1.0.4 OPENPKG_1_STABLE_BP:1.1 OPENPKG_1_1_SOLID:1.1.0.2; locks; strict; comment @# @; 1.10 date 2007.12.22.11.30.04; author rse; state Exp; branches; next 1.9; commitid NBSTklakbBic1qKs; 1.9 date 2005.09.25.20.43.02; author thl; state Exp; branches; next 1.8; 1.8 date 2005.03.15.12.55.29; author ms; state Exp; branches; next 1.7; 1.7 date 2005.02.07.16.19.22; author rse; state dead; branches; next 1.6; 1.6 date 2004.12.31.13.51.21; author rse; state Exp; branches; next 1.5; 1.5 date 2004.12.30.20.37.06; author rse; state Exp; branches; next 1.4; 1.4 date 2004.07.02.09.55.42; author tho; state dead; branches; next 1.3; 1.3 date 2004.04.29.15.06.59; author thl; state Exp; branches; next 1.2; 1.2 date 2003.02.03.14.02.11; author rse; state dead; branches 1.2.2.1; next 1.1; 1.1 date 2002.12.16.15.03.16; author rse; state Exp; branches 1.1.2.1 1.1.4.1; next ; 1.2.2.1 date 2004.04.29.16.17.54; author thl; state Exp; branches; next 1.2.2.2; 1.2.2.2 date 2004.07.06.13.33.26; author tho; state Exp; branches; next 1.2.2.3; 1.2.2.3 date 2004.08.04.14.05.42; author thl; state Exp; branches; next ; 1.1.2.1 date 2002.12.16.15.14.17; author rse; state Exp; branches; next ; 1.1.4.1 date 2003.07.24.20.45.30; author rse; state dead; branches 1.1.4.1.2.1; next ; 1.1.4.1.2.1 date 2004.04.29.19.56.28; author thl; state Exp; branches; next 1.1.4.1.2.2; 1.1.4.1.2.2 date 2004.07.06.13.41.41; author tho; state Exp; branches; next ; desc @@ 1.10 log @just remove the Solaris lex-specific crap and this way be able to again build with latest Flex @ text @Index: texk/gsftopk/gsftopk.c diff -Nau texk/gsftopk/gsftopk.c.orig texk/gsftopk/gsftopk.c --- texk/gsftopk/gsftopk.c.orig 2005-03-15 13:05:16.817449597 +0100 +++ texk/gsftopk/gsftopk.c 2005-03-15 13:06:07.241499293 +0100 @@@@ -417,7 +417,7 @@@@ Boolean dosnames = False; Boolean quiet = False; -struct option { +struct option_loc { const char *longname; short shortname; Boolean has_arg; @@@@ -425,7 +425,7 @@@@ int value; }; -static const struct option options[] = { +static const struct option_loc options[] = { {"test", 't', False, &test, True}, {"mapline", 0, True, &mapline, 0}, {"mapfile", 0, True, &mapfile, 0}, @@@@ -2099,8 +2099,8 @@@@ argp = argv; while (++argp < argv + argc && (*argp)[0] == '-') { - const struct option *opt_ptr; - const struct option *opt; + const struct option_loc *opt_ptr; + const struct option_loc *opt; char *arg = *argp + 1; if (*arg == '\0') --arg; /* this will flag an error later */ Index: texk/dvipsk/texc.script --- texk/dvipsk/texc.script.orig 2005-09-25 22:05:56 +0200 +++ texk/dvipsk/texc.script 2005-09-25 22:05:56 +0200 @@@@ -4,9 +4,7 @@@@ # To use it, say # texc.script tex.lpro texc.lpro # -ed $1 <$2 Index: texk/web2c/omegafonts/pl.l --- texk/web2c/omegafonts/pl.l.orig 2003-05-06 10:30:52 +0200 +++ texk/web2c/omegafonts/pl.l 2007-12-22 12:11:05 +0100 @@@@ -63,12 +63,6 @@@@ %} -/* For Solaris's lex, to increase tables sizes --RP */ -/* Space before number keeps ancient flex happy. */ -%e 4000 -%p 7000 -%n 1000 - ws [ \t]+ hexnumber H{ws}[A-F0-9]+ octnumber O{ws}[0-7]+ @ 1.9 log @get rid of ed(1) dependency, saving vm21-ix86-mandriva10.2 @ text @d53 16 @ 1.8 log @correct illegal already defined option identifier in Linux global C namespace, and requires Xaw3d libs when building with X11 @ text @d34 19 @ 1.7 log @upgrading package: tetex 2.0.2 -> 3.0 @ text @d1 7 a7 4 Index: texk/web2c/omegafonts/pl.l --- texk/web2c/omegafonts/pl.l.orig 2003-01-31 21:45:03 +0100 +++ texk/web2c/omegafonts/pl.l 2004-12-30 21:33:37 +0100 @@@@ -63,6 +63,8 @@@@ d9 8 a16 1 %} d18 16 a33 5 +%array + /* For Solaris's lex, to increase tables sizes --RP */ /* Space before number keeps ancient flex happy. */ %e 4000 @ 1.6 log @ops, fix patch: %array is correct @ text @@ 1.5 log @port to the new Flex version @ text @d8 1 a8 1 +%pointer @ 1.4 log @changed usage of zlib and png from internal to system because of Security Fix (CAN-2002-1363) for png @ text @d1 4 a4 46 --- libs/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ libs/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- libs/libpng/pngerror.c.orig 2002-10-03 13:32:27.000000000 +0200 +++ libs/libpng/pngerror.c 2004-04-28 13:24:22.000000000 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } d6 7 @ 1.3 log @SA-2004.017-png @ text @@ 1.2 log @upgrading package: tetex 1.0.7 -> 2.0 @ text @d1 46 a46 29 --- texk/dvipsk/dvips.c.orig Wed Jul 3 19:13:42 2002 +++ texk/dvipsk/dvips.c Fri Jul 5 09:45:34 2002 @@@@ -64,7 +64,7 @@@@ Boolean cropmarks ; /* add cropmarks? */ Boolean abspage = 0 ; /* are page numbers absolute? */ Boolean tryepsf = 0 ; /* should we try to make it espf? */ -Boolean secure = 0 ; /* make safe for suid */ +Boolean secure = 1 ; /* make safe for suid */ int collatedcopies = 1 ; /* how many collated copies? */ int sectioncopies = 1 ; /* how many times to repeat each section? */ integer pagecopies = 1 ; /* how many times to repeat each page? */ --- texk/dvipsk/dvips.1.orig Sun Nov 1 04:45:06 1998 +++ texk/dvipsk/dvips.1 Fri Jul 5 09:50:52 2002 @@@@ -320,7 +320,9 @@@@ Stack pages in reverse order. Normally, page 1 will be printed first. .TP .B -R -Run in secure mode. This means that ``backtick'' commands from a +Run in secure mode. This is the default; to run unsecurely use the +.B -R0 +option. This means that ``backtick'' commands from a .I \\\special{} or .I \epsffile{} --- texk/kpathsea/tex-make.c.orig Tue Jan 26 21:31:23 1999 +++ texk/kpathsea/tex-make.c Tue Sep 3 12:07:34 2002 @@@@ -138,14 +138,6 @@@@ int save_stderr = -1; #endif a47 43 - /* If the user snuck `backquotes` or $(command) substitutions into the - name, foil them. */ - for (i = 0; i < strlen (cmd); i++) { - if (cmd[i] == '`' || (cmd[i] == '$' && cmd[i+1] == '(')) { - cmd[i] = '#'; - } - } - /* Tell the user we are running the script, so they have a clue as to what's going on if something messes up. But if they asked to discard output, they probably don't want to see this, either. */ @@@@ -259,10 +251,31 @@@@ string args, cmd; const_string prog = spec.program; const_string arg_spec = spec.program_args; + unsigned int i; if (format <= kpse_any_glyph_format) set_maketex_mag (); + /* If the user snuck `backquotes` or $(command) substitutions etc + into the name, foil them. + Thwart ../ in file names too. + */ + for (i = 0; i < strlen (base); i++) { + char c = base[i]; + + if (c == '.' && base[i+1] == '.' && base[i+2] == '/') { + base[i] = base[i+1] = '_'; + continue; + } + + if (('A' <= c && c <= 'Z') + || ('a' <= c && c <= 'z') + || ('0' <= c && c <= '9') + || strchr("_-.", c)) + continue; + base[i] = '#'; + } + /* Here's an awful kludge: if the mode is `/', mktexpk recognizes it as a special case. `kpse_prog_init' sets it to this in the first place when no mode is otherwise specified; this is so @ 1.2.2.1 log @SA-2004.017-png @ text @d1 29 a29 46 --- libs/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ libs/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- libs/libpng/pngerror.c.orig 2002-10-03 13:32:27.000000000 +0200 +++ libs/libpng/pngerror.c 2004-04-28 13:24:22.000000000 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } d31 43 @ 1.2.2.2 log @SA-2004.030; CAN-2002-1363 @ text @d1 2 a2 44 Index: libs/libpng/pngerror.c --- libs/libpng/pngerror.c.orig 2002-10-03 13:32:27 +0200 +++ libs/libpng/pngerror.c 2004-07-05 15:41:33 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } Index: libs/libpng/pngrtran.c --- libs/libpng/pngrtran.c.orig 2002-10-03 13:32:29 +0200 +++ libs/libpng/pngrtran.c 2004-07-05 15:41:33 +0200 @@@@ -1889,8 +1889,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1907,8 +1907,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); d25 23 @ 1.2.2.3 log @SA-2004.035-png; CAN-2004-0597, CAN-2004-0598, CAN-2004-0599 @ text @a66 375 http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-overflow.txt Use to patch libpng-1.0.9 through 1.2.5 This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch03/pngrutil.c --- libs/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ libs/libpng/pngrutil.c Fri Jul 23 18:54:36 2004 @@@@ -1241,7 +1241,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > (png_uint_32)png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04-get-uint-31.txt Use to patch libpng-1.0.6 through 1.2.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h --- libs/libpng/png.h.orig Thu Oct 3 06:32:26 2002 +++ libs/libpng/png.h Fri Jul 23 18:56:27 2004 @@@@ -833,7 +833,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -2655,6 +2659,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch04/pngrutil.c --- libs/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ libs/libpng/pngrutil.c Fri Jul 23 18:56:27 2004 @@@@ -38,6 +38,14 @@@@ # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- libs/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ libs/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06-pngread-chunklength.txt Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c --- libs/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ libs/libpng/pngread.c Fri Jul 23 18:59:57 2004 @@@@ -384,7 +384,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -392,9 +392,6 @@@@ png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@@@ -673,10 +670,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -946,15 +940,12 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch07/pngread.c --- libs/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ libs/libpng/pngread.c Fri Jul 23 19:01:39 2004 @@@@ -1299,6 +1299,9 @@@@ */ png_read_info(png_ptr, info_ptr); + if (info_ptr->height > PNG_UINT_32_MAX/sizeof(png_bytep)) + png_error(png_ptr,"Image is too high to process with png_read_png()"); + /* -------------- image transformations start here ------------------- */ #if defined(PNG_READ_16_TO_8_SUPPORTED) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch08-splt-buffer-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer) diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch08/pngrutil.c --- libs/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ libs/libpng/pngrutil.c Fri Jul 23 19:02:48 2004 @@@@ -1154,8 +1154,18 @@@@ } new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( + if (new_palette.nentries > PNG_SIZE_MAX / sizeof(png_sPLT_entry)) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch09-null-iccp-profile.txt Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8. Libpng-1.0.5 and earlier didn't implement iCCP chunk reading. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch09/pngrutil.c --- libs/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ libs/libpng/pngrutil.c Fri Jul 23 19:04:28 2004 @@@@ -977,8 +977,7 @@@@ png_bytep pC; png_charp profile; png_uint_32 skip = 0; - png_uint_32 profile_size = 0; - png_uint_32 profile_length = 0; + png_uint_32 profile_size, profile_length; png_size_t slength, prefix_length, data_length; png_debug(1, "in png_handle_iCCP\n"); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- libs/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ libs/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -579,7 +579,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -660,7 +660,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -729,7 +729,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -891,7 +891,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); @@@@ -995,7 +995,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place iCCP chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) { png_warning(png_ptr, "Duplicate iCCP chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- libs/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ libs/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- libs/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ libs/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@@@ -1426,8 +1431,8 @@@@ return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @ 1.1 log @include security bugfixes @ text @@ 1.1.4.1 log @mass Merge-From-CURRENT (MFC) in preparation for OpenPKG 1.3 [class BASE only] @ text @@ 1.1.4.1.2.1 log @SA-2004.017-png @ text @d1 29 a29 46 --- libs/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ libs/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- libs/libpng/pngerror.c.orig 2002-10-03 13:32:27.000000000 +0200 +++ libs/libpng/pngerror.c 2004-04-28 13:24:22.000000000 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } d31 43 @ 1.1.4.1.2.2 log @SA-2004.030; CAN-2002-1363 @ text @d1 2 a2 44 Index: libs/libpng/pngerror.c --- libs/libpng/pngerror.c.orig 2002-10-03 13:32:27 +0200 +++ libs/libpng/pngerror.c 2004-07-05 17:20:28 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } Index: libs/libpng/pngrtran.c --- libs/libpng/pngrtran.c.orig 2002-10-03 13:32:29 +0200 +++ libs/libpng/pngrtran.c 2004-07-05 17:20:28 +0200 @@@@ -1889,8 +1889,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1907,8 +1907,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); d25 23 @ 1.1.2.1 log @include security patches @ text @@