Control: tags -1 fixed-upstream patch Hi,
someone has prepared a patch candidate for review at https://sourceforge.net/p/optipng/bugs/65/ It looks like it will prevent the integer overflow. I'm attaching the patch for your convenience. Regards, Markus
From 77ac8e9fd9b2c1aeec3951e2bb50f7cc2c1e92d2 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebast...@pipping.org>
Date: Sun, 19 Nov 2017 16:04:26 +0100
Subject: [PATCH] Prevent integer overflow (bug #65, CVE-2017-1000229)
---
src/minitiff/tiffread.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
index b4910ec..5f9b376 100644
--- a/src/minitiff/tiffread.c
+++ b/src/minitiff/tiffread.c
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
count = tiff_ptr->strip_offsets_count;
if (count == 0 || count > tiff_ptr->height)
goto err_invalid;
+ if (count > (size_t)-1 / sizeof(long))
+ goto err_memory;
tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
if (tiff_ptr->strip_offsets == NULL)
goto err_memory;
--
2.14.2
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Pkg-phototools-devel mailing list Pkg-phototools-devel@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-phototools-devel
