|
@@ -1,7 +1,7 @@
|
|
|
Index: configure
|
|
Index: configure
|
|
|
---- configure 2004-02-11 11:21:42.000000000 +0100
|
|
|
|
|
-+++ configure 2004-03-03 12:16:46.847102980 +0100
|
|
|
|
|
-@@ -1754,21 +1754,6 @@
|
|
|
|
|
|
|
+--- configure.orig 2004-06-14 11:18:55 +0200
|
|
|
|
|
++++ configure 2004-08-11 16:13:39 +0200
|
|
|
|
|
+@@ -1782,21 +1782,6 @@
|
|
|
CFG_FREETYPE=yes
|
|
CFG_FREETYPE=yes
|
|
|
fi
|
|
fi
|
|
|
fi
|
|
fi
|
|
@@ -23,7 +23,7 @@ Index: configure
|
|
|
# auto-detect Session Management support
|
|
# auto-detect Session Management support
|
|
|
if [ "$CFG_SM" = "auto" ]; then
|
|
if [ "$CFG_SM" = "auto" ]; then
|
|
|
if $x11tests/sm.test $XQMAKESPEC $OPT_VERBOSE $L_FLAGS $I_FLAGS; then
|
|
if $x11tests/sm.test $XQMAKESPEC $OPT_VERBOSE $L_FLAGS $I_FLAGS; then
|
|
|
-@@ -2878,6 +2863,21 @@
|
|
|
|
|
|
|
+@@ -2926,6 +2911,21 @@
|
|
|
if [ "$CFG_XKB" = "yes" ]; then
|
|
if [ "$CFG_XKB" = "yes" ]; then
|
|
|
QMAKE_CONFIG="$QMAKE_CONFIG xkb"
|
|
QMAKE_CONFIG="$QMAKE_CONFIG xkb"
|
|
|
fi
|
|
fi
|
|
@@ -45,9 +45,9 @@ Index: configure
|
|
|
elif [ "$PLATFORM_MAC" = "yes" ]; then
|
|
elif [ "$PLATFORM_MAC" = "yes" ]; then
|
|
|
if [ "$CFG_TABLET" = "yes" ]; then
|
|
if [ "$CFG_TABLET" = "yes" ]; then
|
|
|
QMAKE_CONFIG="$QMAKE_CONFIG tablet"
|
|
QMAKE_CONFIG="$QMAKE_CONFIG tablet"
|
|
|
-Index: config.tests/x11/xfreetype.test
|
|
|
|
|
---- config.tests/x11/xfreetype.test 2004-03-03 10:41:51.522773000 +0100
|
|
|
|
|
-+++ config.tests/x11/xfreetype.test 2004-03-03 10:43:42.588911196 +0100
|
|
|
|
|
|
|
+Index: config.test/x11/xfreetype.test
|
|
|
|
|
+--- config.tests/x11/xfreetype.test.orig 2003-12-08 10:04:06 +0100
|
|
|
|
|
++++ config.tests/x11/xfreetype.test 2004-08-11 16:14:43 +0200
|
|
|
@@ -56,7 +56,7 @@
|
|
@@ -56,7 +56,7 @@
|
|
|
XFT=no
|
|
XFT=no
|
|
|
[ "$VERBOSE" = "yes" ] && echo " Could not find Xft lib anywhere in $LIBDIRS"
|
|
[ "$VERBOSE" = "yes" ] && echo " Could not find Xft lib anywhere in $LIBDIRS"
|
|
@@ -68,7 +68,7 @@ Index: config.tests/x11/xfreetype.test
|
|
|
|
|
|
|
|
Index: src/3rdparty/libpng/pngconf.h
|
|
Index: src/3rdparty/libpng/pngconf.h
|
|
|
--- src/3rdparty/libpng/pngconf.h.orig 2003-05-27 17:19:23 +0200
|
|
--- src/3rdparty/libpng/pngconf.h.orig 2003-05-27 17:19:23 +0200
|
|
|
-+++ src/3rdparty/libpng/pngconf.h 2004-07-02 09:22:17 +0200
|
|
|
|
|
|
|
++++ src/3rdparty/libpng/pngconf.h 2004-08-11 16:18:06 +0200
|
|
|
@@ -251,10 +251,6 @@
|
|
@@ -251,10 +251,6 @@
|
|
|
# define PNG_SAVE_BSD_SOURCE
|
|
# define PNG_SAVE_BSD_SOURCE
|
|
|
# undef _BSD_SOURCE
|
|
# undef _BSD_SOURCE
|
|
@@ -82,7 +82,7 @@ Index: src/3rdparty/libpng/pngconf.h
|
|
|
/* include setjmp.h for error handling */
|
|
/* include setjmp.h for error handling */
|
|
|
Index: src/3rdparty/libpng/pngerror.c
|
|
Index: src/3rdparty/libpng/pngerror.c
|
|
|
--- src/3rdparty/libpng/pngerror.c.orig 2003-05-27 17:19:23 +0200
|
|
--- src/3rdparty/libpng/pngerror.c.orig 2003-05-27 17:19:23 +0200
|
|
|
-+++ src/3rdparty/libpng/pngerror.c 2004-07-02 09:22:17 +0200
|
|
|
|
|
|
|
++++ src/3rdparty/libpng/pngerror.c 2004-08-11 16:19:27 +0200
|
|
|
@@ -135,10 +135,13 @@
|
|
@@ -135,10 +135,13 @@
|
|
|
buffer[iout] = 0;
|
|
buffer[iout] = 0;
|
|
|
else
|
|
else
|
|
@@ -101,7 +101,7 @@ Index: src/3rdparty/libpng/pngerror.c
|
|
|
|
|
|
|
|
Index: src/3rdparty/libpng/pngrtran.c
|
|
Index: src/3rdparty/libpng/pngrtran.c
|
|
|
--- src/3rdparty/libpng/pngrtran.c.orig 2003-05-27 17:19:23 +0200
|
|
--- src/3rdparty/libpng/pngrtran.c.orig 2003-05-27 17:19:23 +0200
|
|
|
-+++ src/3rdparty/libpng/pngrtran.c 2004-07-02 09:22:17 +0200
|
|
|
|
|
|
|
++++ src/3rdparty/libpng/pngrtran.c 2004-08-11 16:26:04 +0200
|
|
|
@@ -1889,8 +1889,8 @@
|
|
@@ -1889,8 +1889,8 @@
|
|
|
/* This changes the data from GG to GGXX */
|
|
/* This changes the data from GG to GGXX */
|
|
|
if (flags & PNG_FLAG_FILLER_AFTER)
|
|
if (flags & PNG_FLAG_FILLER_AFTER)
|
|
@@ -169,14 +169,14 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-over
|
|
|
Use to patch libpng-1.0.9 through 1.2.5
|
|
Use to patch libpng-1.0.9 through 1.2.5
|
|
|
This fixes the most dangerous of the newly reported vulnerabilities
|
|
This fixes the most dangerous of the newly reported vulnerabilities
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch03/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c Fri Jul 23 18:54:36 2004
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-11 16:29:37 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:30:11 +0200
|
|
|
@@ -1241,7 +1241,8 @@
|
|
@@ -1241,7 +1241,8 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Missing PLTE before tRNS");
|
|
png_warning(png_ptr, "Missing PLTE before tRNS");
|
|
|
}
|
|
}
|
|
|
-- else if (length > (png_uint_32)png_ptr->num_palette)
|
|
|
|
|
|
|
+- if (length > (png_uint_32)png_ptr->num_palette)
|
|
|
+ if (length > (png_uint_32)png_ptr->num_palette ||
|
|
+ if (length > (png_uint_32)png_ptr->num_palette ||
|
|
|
+ length > PNG_MAX_PALETTE_LENGTH)
|
|
+ length > PNG_MAX_PALETTE_LENGTH)
|
|
|
{
|
|
{
|
|
@@ -188,9 +188,9 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04-get-uint-31.txt
|
|
|
This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX,
|
|
This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX,
|
|
|
and png_get_uint_31(), which are needed by patches 05-08.
|
|
and png_get_uint_31(), which are needed by patches 05-08.
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h
|
|
|
|
|
---- src/3rdparty/libpng/png.h.orig Thu Oct 3 06:32:26 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/png.h Fri Jul 23 18:56:27 2004
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/png.h
|
|
|
|
|
+--- src/3rdparty/libpng/png.h.orig 2003-05-27 17:19:23 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/png.h 2004-08-11 16:31:06 +0200
|
|
|
@@ -833,7 +833,11 @@
|
|
@@ -833,7 +833,11 @@
|
|
|
typedef png_info FAR * FAR * png_infopp;
|
|
typedef png_info FAR * FAR * png_infopp;
|
|
|
|
|
|
|
@@ -213,9 +213,9 @@ diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h
|
|
|
|
|
|
|
|
/* Initialize png_ptr struct for reading, and allocate any other memory.
|
|
/* Initialize png_ptr struct for reading, and allocate any other memory.
|
|
|
* (old interface - DEPRECATED - use png_create_read_struct instead).
|
|
* (old interface - DEPRECATED - use png_create_read_struct instead).
|
|
|
-diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch04/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c Fri Jul 23 18:56:27 2004
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-11 16:29:37 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:32:11 +0200
|
|
|
@@ -38,6 +38,14 @@
|
|
@@ -38,6 +38,14 @@
|
|
|
# endif
|
|
# endif
|
|
|
#endif
|
|
#endif
|
|
@@ -236,9 +236,9 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunkl
|
|
|
Use to patch libpng-1.0.0 through 1.2.5
|
|
Use to patch libpng-1.0.0 through 1.2.5
|
|
|
Requires one of libpng-patch04*
|
|
Requires one of libpng-patch04*
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c
|
|
|
|
|
---- src/3rdparty/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngpread.c Fri Jul 23 18:57:39 2004
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngpread.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngpread.c.orig 2003-05-27 17:19:23 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngpread.c 2004-08-11 16:34:45 +0200
|
|
|
@@ -208,7 +208,7 @@
|
|
@@ -208,7 +208,7 @@
|
|
|
}
|
|
}
|
|
|
|
|
|
|
@@ -275,9 +275,9 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06-pngread-chunkle
|
|
|
Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5.
|
|
Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5.
|
|
|
Requires libpng-patch04-*
|
|
Requires libpng-patch04-*
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c
|
|
|
|
|
---- src/3rdparty/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngread.c Fri Jul 23 18:59:57 2004
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngpread.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngread.c.orig 2003-05-27 17:19:23 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngread.c 2004-08-11 16:36:04 +0200
|
|
|
@@ -384,7 +384,7 @@
|
|
@@ -384,7 +384,7 @@
|
|
|
png_uint_32 length;
|
|
png_uint_32 length;
|
|
|
|
|
|
|
@@ -309,7 +309,7 @@ diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c
|
|
|
|
|
|
|
|
png_reset_crc(png_ptr);
|
|
png_reset_crc(png_ptr);
|
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
|
-@@ -946,15 +940,12 @@
|
|
|
|
|
|
|
+@@ -946,16 +940,13 @@
|
|
|
#endif /* PNG_GLOBAL_ARRAYS */
|
|
#endif /* PNG_GLOBAL_ARRAYS */
|
|
|
|
|
|
|
|
png_read_data(png_ptr, chunk_length, 4);
|
|
png_read_data(png_ptr, chunk_length, 4);
|
|
@@ -320,21 +320,22 @@ diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c
|
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
|
|
|
|
|
|
png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name);
|
|
png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name);
|
|
|
--
|
|
|
|
|
|
|
+
|
|
|
- if (length > PNG_MAX_UINT)
|
|
- if (length > PNG_MAX_UINT)
|
|
|
- png_error(png_ptr, "Invalid chunk length.");
|
|
- png_error(png_ptr, "Invalid chunk length.");
|
|
|
-
|
|
|
|
|
|
|
+-
|
|
|
if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
|
|
if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4))
|
|
|
png_handle_IHDR(png_ptr, info_ptr, length);
|
|
png_handle_IHDR(png_ptr, info_ptr, length);
|
|
|
|
|
+ else if (!png_memcmp(png_ptr->chunk_name, png_IEND, 4))
|
|
|
|
|
|
|
|
http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt
|
|
http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt
|
|
|
Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png().
|
|
Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png().
|
|
|
Requires libpng-patch04-*
|
|
Requires libpng-patch04-*
|
|
|
-
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch07/pngread.c
|
|
|
|
|
---- src/3rdparty/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngread.c Fri Jul 23 19:01:39 2004
|
|
|
|
|
-@@ -1299,6 +1299,9 @@
|
|
|
|
|
|
|
+
|
|
|
|
|
+Index: src/3rdparty/libpng/pngread.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngread.c.orig 2004-08-11 16:36:04 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngread.c 2004-08-11 16:37:39 +0200
|
|
|
|
|
+@@ -1290,6 +1290,9 @@
|
|
|
*/
|
|
*/
|
|
|
png_read_info(png_ptr, info_ptr);
|
|
png_read_info(png_ptr, info_ptr);
|
|
|
|
|
|
|
@@ -351,10 +352,10 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch08-splt-buffer-ove
|
|
|
|
|
|
|
|
The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer)
|
|
The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer)
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch08/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c Fri Jul 23 19:02:48 2004
|
|
|
|
|
-@@ -1154,8 +1154,18 @@
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-05 15:27:41 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:38:53 +0200
|
|
|
|
|
+@@ -1154,8 +1162,18 @@
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
new_palette.nentries = data_length / entry_size;
|
|
new_palette.nentries = data_length / entry_size;
|
|
@@ -379,10 +380,10 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch09-null-iccp-profi
|
|
|
Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8.
|
|
Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8.
|
|
|
Libpng-1.0.5 and earlier didn't implement iCCP chunk reading.
|
|
Libpng-1.0.5 and earlier didn't implement iCCP chunk reading.
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch09/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c Fri Jul 23 19:04:28 2004
|
|
|
|
|
-@@ -977,8 +977,7 @@
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-05 15:27:41 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:40:46 +0200
|
|
|
|
|
+@@ -977,8 +985,7 @@
|
|
|
png_bytep pC;
|
|
png_bytep pC;
|
|
|
png_charp profile;
|
|
png_charp profile;
|
|
|
png_uint_32 skip = 0;
|
|
png_uint_32 skip = 0;
|
|
@@ -399,10 +400,10 @@ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-
|
|
|
03, but the only effect is that libpng will fail to detect misplaced
|
|
03, but the only effect is that libpng will fail to detect misplaced
|
|
|
harmless duplicate chunks.
|
|
harmless duplicate chunks.
|
|
|
|
|
|
|
|
-diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c Fri Jul 23 19:05:40 2004
|
|
|
|
|
-@@ -579,7 +579,7 @@
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-11 16:40:46 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:42:31 +0200
|
|
|
|
|
+@@ -587,7 +587,7 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Out of place gAMA chunk");
|
|
png_warning(png_ptr, "Out of place gAMA chunk");
|
|
|
|
|
|
|
@@ -411,7 +412,7 @@ diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c
|
|
|
#if defined(PNG_READ_sRGB_SUPPORTED)
|
|
#if defined(PNG_READ_sRGB_SUPPORTED)
|
|
|
&& !(info_ptr->valid & PNG_INFO_sRGB)
|
|
&& !(info_ptr->valid & PNG_INFO_sRGB)
|
|
|
#endif
|
|
#endif
|
|
|
-@@ -660,7 +660,7 @@
|
|
|
|
|
|
|
+@@ -668,7 +668,7 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Out of place sBIT chunk");
|
|
png_warning(png_ptr, "Out of place sBIT chunk");
|
|
|
}
|
|
}
|
|
@@ -420,7 +421,7 @@ diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c
|
|
|
{
|
|
{
|
|
|
png_warning(png_ptr, "Duplicate sBIT chunk");
|
|
png_warning(png_ptr, "Duplicate sBIT chunk");
|
|
|
png_crc_finish(png_ptr, length);
|
|
png_crc_finish(png_ptr, length);
|
|
|
-@@ -729,7 +729,7 @@
|
|
|
|
|
|
|
+@@ -737,7 +737,7 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Missing PLTE before cHRM");
|
|
png_warning(png_ptr, "Missing PLTE before cHRM");
|
|
|
|
|
|
|
@@ -429,7 +430,7 @@ diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c
|
|
|
#if defined(PNG_READ_sRGB_SUPPORTED)
|
|
#if defined(PNG_READ_sRGB_SUPPORTED)
|
|
|
&& !(info_ptr->valid & PNG_INFO_sRGB)
|
|
&& !(info_ptr->valid & PNG_INFO_sRGB)
|
|
|
#endif
|
|
#endif
|
|
|
-@@ -891,7 +891,7 @@
|
|
|
|
|
|
|
+@@ -899,7 +899,7 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Out of place sRGB chunk");
|
|
png_warning(png_ptr, "Out of place sRGB chunk");
|
|
|
|
|
|
|
@@ -438,7 +439,7 @@ diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c
|
|
|
{
|
|
{
|
|
|
png_warning(png_ptr, "Duplicate sRGB chunk");
|
|
png_warning(png_ptr, "Duplicate sRGB chunk");
|
|
|
png_crc_finish(png_ptr, length);
|
|
png_crc_finish(png_ptr, length);
|
|
|
-@@ -995,7 +995,7 @@
|
|
|
|
|
|
|
+@@ -1002,7 +1002,7 @@
|
|
|
/* Should be an error, but we can cope with it */
|
|
/* Should be an error, but we can cope with it */
|
|
|
png_warning(png_ptr, "Out of place iCCP chunk");
|
|
png_warning(png_ptr, "Out of place iCCP chunk");
|
|
|
|
|
|
|
@@ -453,25 +454,25 @@ to buffer overflows that might occur when processing very large images.
|
|
|
It causes the reader to reject any images claiming to have more rows or
|
|
It causes the reader to reject any images claiming to have more rows or
|
|
|
columns the png format supports.
|
|
columns the png format supports.
|
|
|
|
|
|
|
|
-diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h
|
|
|
|
|
---- src/3rdparty/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100
|
|
|
|
|
-+++ src/3rdparty/libpng/png.h 2004-07-13 23:18:10.000000000 +0100
|
|
|
|
|
-@@ -835,6 +835,9 @@
|
|
|
|
|
- /* Maximum positive integer used in PNG is (2^31)-1 */
|
|
|
|
|
- #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL)
|
|
|
|
|
-
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/png.h
|
|
|
|
|
+--- src/3rdparty/libpng/png.h.orig 2004-08-11 16:31:06 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/png.h 2004-08-11 16:44:14 +0200
|
|
|
|
|
+@@ -839,6 +839,9 @@
|
|
|
|
|
+ /* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */
|
|
|
|
|
+ #define PNG_MAX_UINT PNG_UINT_31_MAX
|
|
|
|
|
+
|
|
|
+/* Constraints on width, height, (2 ^ 24) - 1*/
|
|
+/* Constraints on width, height, (2 ^ 24) - 1*/
|
|
|
+#define PNG_MAX_DIMENSION 16777215
|
|
+#define PNG_MAX_DIMENSION 16777215
|
|
|
+
|
|
+
|
|
|
/* These describe the color_type field in png_info. */
|
|
/* These describe the color_type field in png_info. */
|
|
|
/* color type masks */
|
|
/* color type masks */
|
|
|
#define PNG_COLOR_MASK_PALETTE 1
|
|
#define PNG_COLOR_MASK_PALETTE 1
|
|
|
-diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c
|
|
|
|
|
---- src/3rdparty/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100
|
|
|
|
|
-+++ src/3rdparty/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100
|
|
|
|
|
-@@ -350,7 +350,11 @@
|
|
|
|
|
|
|
+Index: src/3rdparty/libpng/pngrutil.c
|
|
|
|
|
+--- src/3rdparty/libpng/pngrutil.c.orig 2004-08-11 16:42:31 +0200
|
|
|
|
|
++++ src/3rdparty/libpng/pngrutil.c 2004-08-11 16:45:38 +0200
|
|
|
|
|
+@@ -355,7 +355,11 @@
|
|
|
png_crc_finish(png_ptr, 0);
|
|
png_crc_finish(png_ptr, 0);
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
width = png_get_uint_32(buf);
|
|
width = png_get_uint_32(buf);
|
|
|
+ if (width > PNG_MAX_DIMENSION)
|
|
+ if (width > PNG_MAX_DIMENSION)
|
|
|
+ png_error(png_ptr, "Width is too large");
|
|
+ png_error(png_ptr, "Width is too large");
|
|
@@ -481,28 +482,28 @@ diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c
|
|
|
bit_depth = buf[8];
|
|
bit_depth = buf[8];
|
|
|
color_type = buf[9];
|
|
color_type = buf[9];
|
|
|
compression_type = buf[10];
|
|
compression_type = buf[10];
|
|
|
-@@ -675,7 +679,7 @@
|
|
|
|
|
|
|
+@@ -680,7 +684,7 @@
|
|
|
else
|
|
else
|
|
|
truelen = (png_size_t)png_ptr->channels;
|
|
truelen = (png_size_t)png_ptr->channels;
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
- if (length != truelen)
|
|
- if (length != truelen)
|
|
|
+ if (length != truelen || length > 4)
|
|
+ if (length != truelen || length > 4)
|
|
|
{
|
|
{
|
|
|
png_warning(png_ptr, "Incorrect sBIT chunk length");
|
|
png_warning(png_ptr, "Incorrect sBIT chunk length");
|
|
|
png_crc_finish(png_ptr, length);
|
|
png_crc_finish(png_ptr, length);
|
|
|
-@@ -1400,7 +1405,7 @@
|
|
|
|
|
|
|
+@@ -1415,7 +1419,7 @@
|
|
|
void /* PRIVATE */
|
|
void /* PRIVATE */
|
|
|
png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
|
|
png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
|
|
|
{
|
|
{
|
|
|
- int num, i;
|
|
- int num, i;
|
|
|
+ unsigned int num, i;
|
|
+ unsigned int num, i;
|
|
|
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
|
|
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
png_debug(1, "in png_handle_hIST\n");
|
|
png_debug(1, "in png_handle_hIST\n");
|
|
|
-@@ -1426,8 +1431,8 @@
|
|
|
|
|
|
|
+@@ -1441,8 +1445,8 @@
|
|
|
return;
|
|
return;
|
|
|
}
|
|
}
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
- num = (int)length / 2 ;
|
|
- num = (int)length / 2 ;
|
|
|
- if (num != png_ptr->num_palette)
|
|
- if (num != png_ptr->num_palette)
|
|
|
+ num = length / 2 ;
|
|
+ num = length / 2 ;
|
|
@@ -510,14 +511,13 @@ diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c
|
|
|
{
|
|
{
|
|
|
png_warning(png_ptr, "Incorrect hIST chunk length");
|
|
png_warning(png_ptr, "Incorrect hIST chunk length");
|
|
|
png_crc_finish(png_ptr, length);
|
|
png_crc_finish(png_ptr, length);
|
|
|
-@@ -2868,6 +2873,9 @@
|
|
|
|
|
|
|
+@@ -2883,6 +2887,9 @@
|
|
|
png_read_data(png_ptr, chunk_length, 4);
|
|
png_read_data(png_ptr, chunk_length, 4);
|
|
|
png_ptr->idat_size = png_get_uint_32(chunk_length);
|
|
png_ptr->idat_size = png_get_uint_32(chunk_length);
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
+ if (png_ptr->idat_size > PNG_MAX_UINT)
|
|
+ if (png_ptr->idat_size > PNG_MAX_UINT)
|
|
|
+ png_error(png_ptr, "Invalid chunk length.");
|
|
+ png_error(png_ptr, "Invalid chunk length.");
|
|
|
+
|
|
+
|
|
|
png_reset_crc(png_ptr);
|
|
png_reset_crc(png_ptr);
|
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
|
|
|
if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
|
|
if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
|
|
|
-
|
|
|