Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 34898 Details for
Bug 56307
media-libs/libpng: buffer overflow due to loop offset values
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Mandrake patch for CAN-2002-1363
libpng-1.2.5-transfix.patch (text/plain), 1.89 KB, created by
Thierry Carrez (RETIRED)
on 2004-07-07 03:07:54 UTC
(
hide
)
Description:
Mandrake patch for CAN-2002-1363
Filename:
MIME Type:
Creator:
Thierry Carrez (RETIRED)
Created:
2004-07-07 03:07:54 UTC
Size:
1.89 KB
patch
obsolete
>--- pngrtran.c.can-2002-1363 2002-10-03 05:32:29.000000000 -0600 >+++ pngrtran.c 2004-06-28 12:05:40.000000000 -0600 >@@ -1889,8 +1889,8 @@ > /* This changes the data from GG to GGXX */ > if (flags & PNG_FLAG_FILLER_AFTER) > { >- png_bytep sp = row + (png_size_t)row_width; >- png_bytep dp = sp + (png_size_t)row_width; >+ png_bytep sp = row + (png_size_t)row_width * 2; >+ png_bytep dp = sp + (png_size_t)row_width * 2; > for (i = 1; i < row_width; i++) > { > *(--dp) = hi_filler; >@@ -1907,8 +1907,8 @@ > /* This changes the data from GG to XXGG */ > else > { >- png_bytep sp = row + (png_size_t)row_width; >- png_bytep dp = sp + (png_size_t)row_width; >+ png_bytep sp = row + (png_size_t)row_width * 2; >+ png_bytep dp = sp + (png_size_t)row_width * 2; > for (i = 0; i < row_width; i++) > { > *(--dp) = *(--sp); >@@ -1965,8 +1965,8 @@ > /* This changes the data from RRGGBB to RRGGBBXX */ > if (flags & PNG_FLAG_FILLER_AFTER) > { >- png_bytep sp = row + (png_size_t)row_width * 3; >- png_bytep dp = sp + (png_size_t)row_width; >+ png_bytep sp = row + (png_size_t)row_width * 6; >+ png_bytep dp = sp + (png_size_t)row_width * 2; > for (i = 1; i < row_width; i++) > { > *(--dp) = hi_filler; >@@ -1987,8 +1987,8 @@ > /* This changes the data from RRGGBB to XXRRGGBB */ > else > { >- png_bytep sp = row + (png_size_t)row_width * 3; >- png_bytep dp = sp + (png_size_t)row_width; >+ png_bytep sp = row + (png_size_t)row_width * 6; >+ png_bytep dp = sp + (png_size_t)row_width * 2; > for (i = 0; i < row_width; i++) > { > *(--dp) = *(--sp);
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 56307
: 34898