Blame cups-CVE-2011-2896.patch
|
Tim Waugh |
cf15da |
diff -up cups-1.4.8/filter/image-gif.c.CVE-2011-2896 cups-1.4.8/filter/image-gif.c
|
|
Tim Waugh |
cf15da |
--- cups-1.4.8/filter/image-gif.c.CVE-2011-2896 2011-06-20 21:37:51.000000000 +0100
|
|
Tim Waugh |
cf15da |
+++ cups-1.4.8/filter/image-gif.c 2011-08-19 11:33:37.547911212 +0100
|
|
Tim Waugh |
cf15da |
@@ -648,11 +648,13 @@ gif_read_lzw(FILE *fp, /* I - File to
|
|
Tim Waugh |
cf15da |
|
|
Tim Waugh |
cf15da |
if (code == max_code)
|
|
Tim Waugh |
cf15da |
{
|
|
Tim Waugh |
cf15da |
- *sp++ = firstcode;
|
|
Tim Waugh |
cf15da |
- code = oldcode;
|
|
Tim Waugh |
cf15da |
+ if (sp < (stack + 8192))
|
|
Tim Waugh |
cf15da |
+ *sp++ = firstcode;
|
|
Tim Waugh |
cf15da |
+
|
|
Tim Waugh |
cf15da |
+ code = oldcode;
|
|
Tim Waugh |
cf15da |
}
|
|
Tim Waugh |
cf15da |
|
|
Tim Waugh |
cf15da |
- while (code >= clear_code)
|
|
Tim Waugh |
cf15da |
+ while (code >= clear_code && sp < (stack + 8192))
|
|
Tim Waugh |
cf15da |
{
|
|
Tim Waugh |
cf15da |
*sp++ = table[1][code];
|
|
Tim Waugh |
cf15da |
if (code == table[0][code])
|
|
Tim Waugh |
cf15da |
@@ -661,8 +663,10 @@ gif_read_lzw(FILE *fp, /* I - File to
|
|
Tim Waugh |
cf15da |
code = table[0][code];
|
|
Tim Waugh |
cf15da |
}
|
|
Tim Waugh |
cf15da |
|
|
Tim Waugh |
cf15da |
- *sp++ = firstcode = table[1][code];
|
|
Tim Waugh |
cf15da |
- code = max_code;
|
|
Tim Waugh |
cf15da |
+ if (sp < (stack + 8192))
|
|
Tim Waugh |
cf15da |
+ *sp++ = firstcode = table[1][code];
|
|
Tim Waugh |
cf15da |
+
|
|
Tim Waugh |
cf15da |
+ code = max_code;
|
|
Tim Waugh |
cf15da |
|
|
Tim Waugh |
cf15da |
if (code < 4096)
|
|
Tim Waugh |
cf15da |
{
|