summaryrefslogtreecommitdiff
path: root/user/evince/CVE-2019-11459.patch
diff options
context:
space:
mode:
authorMax Rees <maxcrees@me.com>2019-09-13 03:52:20 -0500
committerMax Rees <maxcrees@me.com>2019-09-13 19:01:40 -0500
commit6715f997836e8fc8205c8ee6657dcb6084bca1e1 (patch)
tree2a954dac828c5a9c2b4af6d24e6b2566e9857561 /user/evince/CVE-2019-11459.patch
parent94981d3fd78388a8d75ab142fb91c70859e72de7 (diff)
downloadpackages-6715f997836e8fc8205c8ee6657dcb6084bca1e1.tar.gz
packages-6715f997836e8fc8205c8ee6657dcb6084bca1e1.tar.bz2
packages-6715f997836e8fc8205c8ee6657dcb6084bca1e1.tar.xz
packages-6715f997836e8fc8205c8ee6657dcb6084bca1e1.zip
user/evince: [CVE] patch CVE-2019-11459 (#148)
Diffstat (limited to 'user/evince/CVE-2019-11459.patch')
-rw-r--r--user/evince/CVE-2019-11459.patch72
1 files changed, 72 insertions, 0 deletions
diff --git a/user/evince/CVE-2019-11459.patch b/user/evince/CVE-2019-11459.patch
new file mode 100644
index 000000000..b331a0c30
--- /dev/null
+++ b/user/evince/CVE-2019-11459.patch
@@ -0,0 +1,72 @@
+From 234f034a4d15cd46dd556f4945f99fbd57ef5f15 Mon Sep 17 00:00:00 2001
+From: Jason Crain <jcrain@src.gnome.org>
+Date: Mon, 15 Apr 2019 23:06:36 -0600
+Subject: [PATCH] tiff: Handle failure from TIFFReadRGBAImageOriented
+
+The TIFFReadRGBAImageOriented function returns zero if it was unable to
+read the image. Return NULL in this case instead of displaying
+uninitialized memory.
+
+Fixes #1129
+---
+ backend/tiff/tiff-document.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/backend/tiff/tiff-document.c b/backend/tiff/tiff-document.c
+index 7715031b..38bb3bd8 100644
+--- a/backend/tiff/tiff-document.c
++++ b/backend/tiff/tiff-document.c
+@@ -292,18 +292,22 @@ tiff_document_render (EvDocument *document,
+ g_warning("Failed to allocate memory for rendering.");
+ return NULL;
+ }
+-
++
++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff,
++ width, height,
++ (uint32 *)pixels,
++ orientation, 0)) {
++ g_warning ("Failed to read TIFF image.");
++ g_free (pixels);
++ return NULL;
++ }
++
+ surface = cairo_image_surface_create_for_data (pixels,
+ CAIRO_FORMAT_RGB24,
+ width, height,
+ rowstride);
+ cairo_surface_set_user_data (surface, &key,
+ pixels, (cairo_destroy_func_t)g_free);
+-
+- TIFFReadRGBAImageOriented (tiff_document->tiff,
+- width, height,
+- (uint32 *)pixels,
+- orientation, 0);
+ pop_handlers ();
+
+ /* Convert the format returned by libtiff to
+@@ -384,13 +388,17 @@ tiff_document_get_thumbnail (EvDocument *document,
+ if (!pixels)
+ return NULL;
+
++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff,
++ width, height,
++ (uint32 *)pixels,
++ ORIENTATION_TOPLEFT, 0)) {
++ g_free (pixels);
++ return NULL;
++ }
++
+ pixbuf = gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, TRUE, 8,
+ width, height, rowstride,
+ (GdkPixbufDestroyNotify) g_free, NULL);
+- TIFFReadRGBAImageOriented (tiff_document->tiff,
+- width, height,
+- (uint32 *)pixels,
+- ORIENTATION_TOPLEFT, 0);
+ pop_handlers ();
+
+ ev_render_context_compute_scaled_size (rc, width, height * (x_res / y_res),
+--
+2.21.0
+