diff options
| author | Dirk Meyer <dinoex@FreeBSD.org> | 2009-09-25 06:21:42 +0000 |
|---|---|---|
| committer | Dirk Meyer <dinoex@FreeBSD.org> | 2009-09-25 06:21:42 +0000 |
| commit | ba1248c3ca915f894216a3e3069ef85545d20a4d (patch) | |
| tree | ba3384d87a45299f7667a4eae3796fc4930377b4 /graphics/xv | |
| parent | 3869973c5dd38b3885e5f463052de8a602eddab5 (diff) | |
| download | ports-ba1248c3ca915f894216a3e3069ef85545d20a4d.tar.gz ports-ba1248c3ca915f894216a3e3069ef85545d20a4d.zip | |
- Security fix
fix out of bound error, introduced in jumbo2 patch
Reported by: naddy (Christian Weisgerber)
Submitted by: Patrick Keshishian
Obtained from: openbsd
Feature safe: yes
Notes
Notes:
svn path=/head/; revision=242057
Diffstat (limited to 'graphics/xv')
| -rw-r--r-- | graphics/xv/Makefile | 2 | ||||
| -rw-r--r-- | graphics/xv/files/patch-xvjpeg.c | 21 |
2 files changed, 22 insertions, 1 deletions
diff --git a/graphics/xv/Makefile b/graphics/xv/Makefile index 81bc7d23c996..228504999a29 100644 --- a/graphics/xv/Makefile +++ b/graphics/xv/Makefile @@ -7,7 +7,7 @@ PORTNAME= xv PORTVERSION= 3.10a -PORTREVISION= 10 +PORTREVISION= 11 CATEGORIES+= graphics MASTER_SITES= ftp://ftp.cis.upenn.edu/pub/xv/:base \ SF/png-mng/XV%20jumbo%20patches/20070520 diff --git a/graphics/xv/files/patch-xvjpeg.c b/graphics/xv/files/patch-xvjpeg.c new file mode 100644 index 000000000000..ebbf966d0863 --- /dev/null +++ b/graphics/xv/files/patch-xvjpeg.c @@ -0,0 +1,21 @@ +$OpenBSD$ +--- xvjpeg.c.orig Fri Aug 28 13:41:30 2009 ++++ xvjpeg.c Fri Aug 28 18:58:46 2009 +@@ -696,7 +696,7 @@ L2: + if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* R */ + if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* G */ + if ((cmy = *q++ - k) < 0) cmy = 0; *p++ = cmy; /* B */ +- } while (++q <= pic_end); ++ } while (++q < pic_end); + } + else { /* assume normal data */ + register byte *q = pic; +@@ -707,7 +707,7 @@ L2: + if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* R */ + if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* G */ + if ((cmy = k - *q++) < 0) cmy = 0; *p++ = cmy; /* B */ +- } while (++q <= pic_end); ++ } while (++q < pic_end); + } + pic = realloc(pic,p-pic); /* Release extra storage */ + } |