Package: imlib2 / 1.4.8-1

03_CVE-2011-5326.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
From c94d83ccab15d5ef02f88d42dce38ed3f0892882 Mon Sep 17 00:00:00 2001
From: Kim Woelders <kim@woelders.dk>
Date: Wed, 6 Apr 2016 17:42:17 +0200
Subject: Fix potential divide-by-zero in imlib_image_draw_ellipse().

Attempting to draw a 2x1 ellipse with e.g. imlib_image_draw_ellipse(x, y, 2, 1)
causes a divide-by-zero.
It seems happy enough to draw 1x1, 1x2 and 2x2, but not 2x1.

Patch by Simon Lees.

https://bugs.debian.org/639414
---
 src/lib/ellipse.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

--- a/src/lib/ellipse.c
+++ b/src/lib/ellipse.c
@@ -71,6 +71,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(color, bp + len);
 
+        if (dx < 1)
+           dx = 1;
+
         dy += b2;
         yy -= ((dy << 16) / dx);
         lx--;
@@ -123,6 +126,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(color, bp + len);
 
+        if (dy < 1)
+           dy = 1;
+
         dx -= a2;
         xx += ((dx << 16) / dy);
         ty++;
@@ -222,6 +228,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(col1, bp + len);
 
+        if (dx < 1)
+           dx = 1;
+
         dy += b2;
         yy -= ((dy << 16) / dx);
         lx--;
@@ -295,6 +304,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(col1, bp + len);
 
+        if (dy < 1)
+           dy = 1;
+
         dx -= a2;
         xx += ((dx << 16) / dy);
         ty++;
@@ -395,6 +407,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(color, bp + len);
 
+        if (dx < 1)
+           dx = 1;
+
         dy += b2;
         yy -= ((dy << 16) / dx);
         lx--;
@@ -453,6 +468,9 @@
         if (((unsigned)by < (unsigned)clh) && (len > 0))
            sfunc(color, bpp, len);
 
+        if (dy < 1)
+           dy = 1;
+
         dx -= a2;
         xx += ((dx << 16) / dy);
         ty++;
@@ -556,6 +574,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(col1, bp + len);
 
+        if (dx < 1)
+           dx = 1;
+
         dy += b2;
         yy -= ((dy << 16) / dx);
         lx--;
@@ -629,6 +650,9 @@
         if (IN_RANGE(rx, by, clw, clh))
            pfunc(col1, bp + len);
 
+        if (dy < 1)
+           dy = 1;
+
         dx -= a2;
         xx += ((dx << 16) / dy);
         ty++;