Hello community, here is the log from the commit of package gd for openSUSE:Factory checked in at 2014-04-09 13:01:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gd (Old) and /work/SRC/openSUSE:Factory/.gd.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gd" Changes: -------- --- /work/SRC/openSUSE:Factory/gd/gd.changes 2013-12-30 09:52:09.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.gd.new/gd.changes 2014-04-09 13:01:05.000000000 +0200 @@ -1,0 +2,6 @@ +Fri Apr 4 12:21:22 UTC 2014 - [email protected] + +- fixed NULL ptr deref in GD XPM decoder [bnc#868624] + * CVE-2014-2497.patch + +------------------------------------------------------------------- New: ---- gd-2.1.0-CVE-2014-2497.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gd.spec ++++++ --- /var/tmp/diff_new_pack.lwTyn3/_old 2014-04-09 13:01:05.000000000 +0200 +++ /var/tmp/diff_new_pack.lwTyn3/_new 2014-04-09 13:01:05.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package gd # -# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -36,6 +36,7 @@ Patch3: gd-aliasing.patch # could be upstreamed? Patch4: gd-autoconf.patch +Patch5: gd-2.1.0-CVE-2014-2497.patch BuildRequires: fontconfig-devel BuildRequires: freetype2-devel BuildRequires: libjpeg-devel @@ -78,6 +79,7 @@ %patch2 %patch3 %patch4 +%patch5 %build autoreconf -fiv ++++++ gd-2.1.0-CVE-2014-2497.patch ++++++ Description: Patch to fix PHP bug 66901. Author: Andres Mejia <[email protected]> Forwarded: no Index: src/gdxpm.c =================================================================== --- src/gdxpm.c.orig 2014-04-04 12:56:02.570160501 +0200 +++ src/gdxpm.c 2014-04-04 13:01:24.031976322 +0200 @@ -62,6 +62,14 @@ for(i = 0; i < number; i++) { char *c_color = image.colorTable[i].c_color; + if (!image.colorTable[i].c_color) + { + /* unsupported color key or color key not defined */ + gdImageDestroy(im); + gdFree(colors); + im = 0; + goto done; + } if(strcmp(c_color, "None") == 0) { colors[i] = gdImageGetTransparent(im); if(colors[i] == -1) colors[i] = gdImageColorAllocate(im, 0, 0, 0); -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
