Compare commits

...
Sign in to create a new pull request.

3 commits

Author SHA1 Message Date
Filip Januš
5904f4afb1 Fix null pointer reference
Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1599032
Add patch from upstream a93eac0e84
2020-01-31 10:42:42 +01:00
Ondrej Dubaj
f2679e6919 Potential double-free in gdImage*Ptr()
Whenever `gdImage*Ptr()` calls `gdImage*Ctx()` and the latter fails, we
must not call `gdDPExtractData()`; otherwise a double-free would
happen.  Since `gdImage*Ctx()` are void functions, and we can't change
that for BC reasons, we're introducing static helpers which are used
internally.

We're adding a regression test for `gdImageJpegPtr()`, but not for
`gdImageGifPtr()` and `gdImageWbmpPtr()` since we don't know how to
trigger failure of the respective `gdImage*Ctx()` calls.

This potential security issue has been reported by Solmaz Salimi (aka.
Rooney).
2019-11-01 10:41:22 +01:00
Ondrej Dubaj
68ba206e20 Fixed heap based buffer overflow in gd_color_match.c:gdImageColorMatch() in libgd as used in imagecolormatch() 2019-11-01 10:40:53 +01:00

12
gd.spec
View file

@ -9,7 +9,7 @@
Summary: A graphics library for quick creation of PNG or JPEG images
Name: gd
Version: 2.2.5
Release: 12%{?prever}%{?short}%{?dist}
Release: 10%{?prever}%{?short}%{?dist}
License: MIT
URL: http://libgd.github.io/
%if 0%{?commit:1}
@ -170,22 +170,16 @@ grep %{version} $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gdlib.pc
%changelog
* Fri Jan 31 2020 Filip Januš <fjanus@redhat.com> - 2.2.5-12
* Fri Jan 31 2020 Filip Januš <fjanus@redhat.com> - 2.2.5-10
- Add patch(gd-2.2.5-null-pointer.patch) - fix Null pointer reference in gdImageClone (gdImagePtr src)
- Resolves: #1599032
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Nov 01 2019 odubaj@redhat.com - 2.2.5-10
* Fri Nov 01 2019 odubaj@redhat.com - 2.2.5-9
- Fixed heap based buffer overflow in gd_color_match.c:gdImageColorMatch() in libgd as used in imagecolormatch()
- Resolves: RHBZ#1678104 (CVE-2019-6977)
- Fixed potential double-free in gdImage*Ptr()
- Resolves: RHBZ#1671391 (CVE-2019-6978)
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild