openpkg-packages/perl-tk/perl-tk.patch

--- Tk-804.027/PNG/libpng/pngrtran.c.orig	Wed Oct  2 20:20:24 2002
+++ Tk-804.027/PNG/libpng/pngrtran.c	Wed Jan 15 11:30:23 2003
@@ -1965,8 +1965,8 @@
          /* This changes the data from RRGGBB to RRGGBBXX */
          if (flags & PNG_FLAG_FILLER_AFTER)
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = hi_filler;
@@ -1987,8 +1987,8 @@
          /* This changes the data from RRGGBB to XXRRGGBB */
          else
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);

Steve G <linux_4ever@yahoo.com>
Libpng accesses memory that is out of bounds when creating an error message

Index: pngerror.c
--- Tk-804.027/PNG/libpng/pngerror.c.orig	2002-10-03 13:32:27.000000000 +0200
+++ Tk-804.027/PNG/libpng/pngerror.c	2004-04-28 13:24:22.000000000 +0200
@@ -135,10 +135,13 @@
       buffer[iout] = 0;
    else
    {
+      png_size_t len;
+      if ((len = png_strlen(error_message)) > 63)
+          len = 63;
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_memcpy(buffer+iout, error_message, 64);
-      buffer[iout+63] = 0;
+      png_memcpy(buffer+iout, error_message, len);
+      buffer[iout+len] = 0;
    }
 }
 
--- Tk-PNG-2.005/libpng/pngrtran.c.orig	Wed Oct  2 20:20:24 2002
+++ Tk-PNG-2.005/libpng/pngrtran.c	Wed Jan 15 11:30:23 2003
@@ -1965,8 +1965,8 @@
          /* This changes the data from RRGGBB to RRGGBBXX */
          if (flags & PNG_FLAG_FILLER_AFTER)
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 1; i < row_width; i++)
             {
                *(--dp) = hi_filler;
@@ -1987,8 +1987,8 @@
          /* This changes the data from RRGGBB to XXRRGGBB */
          else
          {
-            png_bytep sp = row + (png_size_t)row_width * 3;
-            png_bytep dp = sp  + (png_size_t)row_width;
+            png_bytep sp = row + (png_size_t)row_width * 6;
+            png_bytep dp = sp  + (png_size_t)row_width * 2;
             for (i = 0; i < row_width; i++)
             {
                *(--dp) = *(--sp);

Steve G <linux_4ever@yahoo.com>
Libpng accesses memory that is out of bounds when creating an error message

Index: pngerror.c
--- Tk-PNG-2.005/libpng/pngerror.c.orig	2004-04-29 15:33:33.000000000 +0200
+++ Tk-PNG-2.005/libpng/pngerror.c	2004-04-29 15:35:46.000000000 +0200
@@ -81,11 +81,15 @@
 
    if (message == NULL)
       buffer[iout] = 0;
-   else {
+   else
+   {
+      png_size_t len;
+      if ((len = png_strlen(message)) > 63)
+          len = 63;
       buffer[iout++] = ':';
       buffer[iout++] = ' ';
-      png_memcpy(buffer+iout, message, 64);
-      buffer[iout+63] = 0;
+      png_memcpy(buffer+iout, message, len);
+      buffer[iout+len] = 0;
    }
 }