2 files changed, 41 insertions, 0 deletions
diff --git a/graphics/sdl_image/files/patch-IMG_gif.c b/graphics/sdl_image/files/patch-IMG_gif.c
new file mode 100644
index 000000000000..23e970bd147a
--- /dev/null
+++ b/graphics/sdl_image/files/patch-IMG_gif.c
@@ -0,0 +1,13 @@
+--- IMG_gif.c	2007/02/13 10:09:17	2970
++++ IMG_gif.c	2007/12/28 16:43:56	3462
+@@ -418,6 +418,10 @@
+     static int stack[(1 << (MAX_LWZ_BITS)) * 2], *sp;
+     register int i;
+ 
++    /* Fixed buffer overflow found by Michael Skladnikiewicz */
++    if (input_code_size > MAX_LWZ_BITS)
++        return -1;
++
+     if (flag) {
+ 	set_code_size = input_code_size;
+ 	code_size = set_code_size + 1;
diff --git a/graphics/sdl_image/files/patch-IMG_lbm.c b/graphics/sdl_image/files/patch-IMG_lbm.c
new file mode 100644
index 000000000000..5f67e6ded16e
--- /dev/null
+++ b/graphics/sdl_image/files/patch-IMG_lbm.c
@@ -0,0 +1,28 @@
+--- IMG_lbm.c	2007/07/20 04:37:11	3341
++++ IMG_lbm.c	2008/01/03 20:05:34	3521
+@@ -28,6 +28,7 @@
+    EHB and HAM (specific Amiga graphic chip modes) support added by Marc Le Douarain
+    (http://www.multimania.com/mavati) in December 2003.
+    Stencil and colorkey fixes by David Raulo (david.raulo AT free DOT fr) in February 2004.
++   Buffer overflow fix in RLE decompression by David Raulo in January 2008.
+ */
+ 
+ #include <stdio.h>
+@@ -328,7 +329,7 @@
+ 						count ^= 0xFF;
+ 						count += 2; /* now it */
+ 
+-						if ( !SDL_RWread( src, &color, 1, 1 ) )
++						if ( ( count > remainingbytes ) || !SDL_RWread( src, &color, 1, 1 ) )
+ 						{
+ 						   error="error reading BODY chunk";
+ 							goto done;
+@@ -339,7 +340,7 @@
+ 					{
+ 						++count;
+ 
+-						if ( !SDL_RWread( src, ptr, count, 1 ) )
++						if ( ( count > remainingbytes ) || !SDL_RWread( src, ptr, count, 1 ) )
+ 						{
+ 						   error="error reading BODY chunk";
+ 							goto done;