From 7d1128914cff70ee8c136baf6832ec66ad64bf50 Mon Sep 17 00:00:00 2001 From: Markeryang <747675909@qq.com> Date: Mon, 10 Aug 2020 11:18:18 +0800 Subject: [PATCH] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=200000-CVE?= =?UTF-8?q?-2019-16865-1.patch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 0000-CVE-2019-16865-1.patch | 62 ------------------------------------- 1 file changed, 62 deletions(-) delete mode 100644 0000-CVE-2019-16865-1.patch diff --git a/0000-CVE-2019-16865-1.patch b/0000-CVE-2019-16865-1.patch deleted file mode 100644 index 5635a0b..0000000 --- a/0000-CVE-2019-16865-1.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 5d4b5d152f3408352d600ba97980061ea054e8e9 Mon Sep 17 00:00:00 2001 -From: Andrew Murray -Date: Sun, 29 Sep 2019 14:16:30 +1000 -Subject: [PATCH] Corrected negative seeks - -Signed-off-by: hanxinke ---- - src/PIL/PsdImagePlugin.py | 6 ++++-- - src/libImaging/RawDecode.c | 11 +++++++++-- - 2 files changed, 13 insertions(+), 4 deletions(-) - -diff --git a/src/PIL/PsdImagePlugin.py b/src/PIL/PsdImagePlugin.py -index 2d64ecd..e82dda2 100644 ---- a/src/PIL/PsdImagePlugin.py -+++ b/src/PIL/PsdImagePlugin.py -@@ -209,9 +209,11 @@ def _layerinfo(file): - # skip over blend flags and extra information - filler = read(12) - name = "" -- size = i32(read(4)) -+ size = i32(read(4)) # length of the extra data field - combined = 0 - if size: -+ data_end = file.tell() + size -+ - length = i32(read(4)) - if length: - mask_y = i32(read(4)) -@@ -233,7 +235,7 @@ def _layerinfo(file): - name = read(length).decode('latin-1', 'replace') - combined += length + 1 - -- file.seek(size - combined, 1) -+ file.seek(data_end) - layers.append((name, mode, (x0, y0, x1, y1))) - - # get tiles -diff --git a/src/libImaging/RawDecode.c b/src/libImaging/RawDecode.c -index 40c0cb7..d4b7994 100644 ---- a/src/libImaging/RawDecode.c -+++ b/src/libImaging/RawDecode.c -@@ -33,8 +33,15 @@ ImagingRawDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) - - /* get size of image data and padding */ - state->bytes = (state->xsize * state->bits + 7) / 8; -- rawstate->skip = (rawstate->stride) ? -- rawstate->stride - state->bytes : 0; -+ if (rawstate->stride) { -+ rawstate->skip = rawstate->stride - state->bytes; -+ if (rawstate->skip < 0) { -+ state->errcode = IMAGING_CODEC_CONFIG; -+ return -1; -+ } -+ } else { -+ rawstate->skip = 0; -+ } - - /* check image orientation */ - if (state->ystep < 0) { --- -2.19.1 -