Package: gdk-pixbuf / 2.31.1-2+deb8u7

CVE-2015-7673/0003-io-tga-Colormaps-are-always-present-so-always-parse-.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
From 6ddca835100107e6b5841ce9d56074f6d98c387e Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Sun, 20 Sep 2015 00:29:59 +0200
Subject: [PATCH] io-tga: Colormaps are always present, so always parse them.

We might end up with a colormap with 0 entries, but whatever, it's a
colormap.
---
 gdk-pixbuf/io-tga.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/gdk-pixbuf/io-tga.c b/gdk-pixbuf/io-tga.c
index 70d1892..156a416 100644
--- a/gdk-pixbuf/io-tga.c
+++ b/gdk-pixbuf/io-tga.c
@@ -356,9 +356,8 @@ static gboolean fill_in_context(TGAContext *ctx, GError **err)
 		 || (ctx->hdr->type == TGA_TYPE_RLE_TRUECOLOR)
 		 || (ctx->hdr->type == TGA_TYPE_RLE_GRAYSCALE));
 
-	if (ctx->hdr->has_cmap)
-		ctx->cmap_size = ((ctx->hdr->cmap_bpp + 7) >> 3) *
-			LE16(ctx->hdr->cmap_n_colors);
+        ctx->cmap_size = ((ctx->hdr->cmap_bpp + 7) >> 3) *
+                LE16(ctx->hdr->cmap_n_colors);
 
 	alpha = ((ctx->hdr->bpp == 16) || 
 		 (ctx->hdr->bpp == 32) ||
@@ -717,13 +716,6 @@ static gboolean try_colormap(TGAContext *ctx, GError **err)
 
 	g_return_val_if_fail(ctx != NULL, FALSE);
 
-        if (ctx->cmap_size == 0) {
-		g_set_error_literal(err, GDK_PIXBUF_ERROR,
-                                    GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
-                                    _("Image is corrupted or truncated"));
-			return FALSE;
-        }
-
         n_colors = LE16(ctx->hdr->cmap_n_colors);
         ctx->cmap = colormap_new (n_colors);
 	if (!ctx->cmap) {
@@ -865,7 +857,7 @@ static gboolean try_preload(TGAContext *ctx, GError **err)
 			return TRUE;
 		}
 	}
-	if (ctx->hdr->has_cmap && !ctx->cmap) {
+	if (!ctx->cmap) {
 		if (ctx->in->size >= ctx->cmap_size) {
 			if (!try_colormap(ctx, err))
 				return FALSE;
-- 
2.6.1