gnu/packages/patches/optipng-CVE-2017-1000229.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Fix CVE-2017-1000229:

https://security-tracker.debian.org/tracker/CVE-2017-1000229
https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000229.html
https://nvd.nist.gov/vuln/detail/CVE-2017-1000229

Patch copied from upstream bug tracker:
https://sourceforge.net/p/optipng/bugs/65/

diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
index b4910ec..5f9b376 100644
--- a/src/minitiff/tiffread.c
+++ b/src/minitiff/tiffread.c
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
         count = tiff_ptr->strip_offsets_count;
         if (count == 0 || count > tiff_ptr->height)
             goto err_invalid;
+        if (count > (size_t)-1 / sizeof(long))
+            goto err_memory;
         tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
         if (tiff_ptr->strip_offsets == NULL)
             goto err_memory;