删除文件 0000-CVE-2019-16865-1.patch
This commit is contained in:
parent
51b25f6b2e
commit
7d1128914c
@ -1,62 +0,0 @@
|
||||
From 5d4b5d152f3408352d600ba97980061ea054e8e9 Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Murray <radarhere@users.noreply.github.com>
|
||||
Date: Sun, 29 Sep 2019 14:16:30 +1000
|
||||
Subject: [PATCH] Corrected negative seeks
|
||||
|
||||
Signed-off-by: hanxinke <hanxinke@huawei.com>
|
||||
---
|
||||
src/PIL/PsdImagePlugin.py | 6 ++++--
|
||||
src/libImaging/RawDecode.c | 11 +++++++++--
|
||||
2 files changed, 13 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/PIL/PsdImagePlugin.py b/src/PIL/PsdImagePlugin.py
|
||||
index 2d64ecd..e82dda2 100644
|
||||
--- a/src/PIL/PsdImagePlugin.py
|
||||
+++ b/src/PIL/PsdImagePlugin.py
|
||||
@@ -209,9 +209,11 @@ def _layerinfo(file):
|
||||
# skip over blend flags and extra information
|
||||
filler = read(12)
|
||||
name = ""
|
||||
- size = i32(read(4))
|
||||
+ size = i32(read(4)) # length of the extra data field
|
||||
combined = 0
|
||||
if size:
|
||||
+ data_end = file.tell() + size
|
||||
+
|
||||
length = i32(read(4))
|
||||
if length:
|
||||
mask_y = i32(read(4))
|
||||
@@ -233,7 +235,7 @@ def _layerinfo(file):
|
||||
name = read(length).decode('latin-1', 'replace')
|
||||
combined += length + 1
|
||||
|
||||
- file.seek(size - combined, 1)
|
||||
+ file.seek(data_end)
|
||||
layers.append((name, mode, (x0, y0, x1, y1)))
|
||||
|
||||
# get tiles
|
||||
diff --git a/src/libImaging/RawDecode.c b/src/libImaging/RawDecode.c
|
||||
index 40c0cb7..d4b7994 100644
|
||||
--- a/src/libImaging/RawDecode.c
|
||||
+++ b/src/libImaging/RawDecode.c
|
||||
@@ -33,8 +33,15 @@ ImagingRawDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
||||
|
||||
/* get size of image data and padding */
|
||||
state->bytes = (state->xsize * state->bits + 7) / 8;
|
||||
- rawstate->skip = (rawstate->stride) ?
|
||||
- rawstate->stride - state->bytes : 0;
|
||||
+ if (rawstate->stride) {
|
||||
+ rawstate->skip = rawstate->stride - state->bytes;
|
||||
+ if (rawstate->skip < 0) {
|
||||
+ state->errcode = IMAGING_CODEC_CONFIG;
|
||||
+ return -1;
|
||||
+ }
|
||||
+ } else {
|
||||
+ rawstate->skip = 0;
|
||||
+ }
|
||||
|
||||
/* check image orientation */
|
||||
if (state->ystep < 0) {
|
||||
--
|
||||
2.19.1
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user