diff --git a/0003-CVE-2019-16865-4.patch b/0003-CVE-2019-16865-4.patch deleted file mode 100644 index b809da0..0000000 --- a/0003-CVE-2019-16865-4.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 1f90f191cef5f4d18cb229e3717d0b2010e9b434 Mon Sep 17 00:00:00 2001 -From: Andrew Murray -Date: Mon, 30 Sep 2019 18:45:43 +1000 -Subject: [PATCH] Catch buffer overruns - -Signed-off-by: hanxinke ---- - src/libImaging/FliDecode.c | 14 +++++++++++--- - src/libImaging/PcxDecode.c | 5 +++++ - src/libImaging/SgiRleDecode.c | 5 +++++ - 3 files changed, 21 insertions(+), 3 deletions(-) - -diff --git a/src/libImaging/FliDecode.c b/src/libImaging/FliDecode.c -index 6d22c6c..600528e 100644 ---- a/src/libImaging/FliDecode.c -+++ b/src/libImaging/FliDecode.c -@@ -30,7 +30,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) - { - UINT8* ptr; - int framesize; -- int c, chunks; -+ int c, chunks, advance; - int l, lines; - int i, j, x = 0, y, ymax; - -@@ -59,10 +59,16 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) - - chunks = I16(ptr+6); - ptr += 16; -+ bytes -= 16; - - /* Process subchunks */ - for (c = 0; c < chunks; c++) { -- UINT8 *data = ptr + 6; -+ UINT8* data; -+ if (bytes < 10) { -+ state->errcode = IMAGING_CODEC_OVERRUN; -+ return -1; -+ } -+ data = ptr + 6; - switch (I16(ptr+4)) { - case 4: case 11: - /* FLI COLOR chunk */ -@@ -198,7 +204,9 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) - state->errcode = IMAGING_CODEC_UNKNOWN; - return -1; - } -- ptr += I32(ptr); -+ advance = I32(ptr); -+ ptr += advance; -+ bytes -= advance; - } - - return -1; /* end of frame */ -diff --git a/src/libImaging/PcxDecode.c b/src/libImaging/PcxDecode.c -index e5417f1..51de069 100644 ---- a/src/libImaging/PcxDecode.c -+++ b/src/libImaging/PcxDecode.c -@@ -22,6 +22,11 @@ ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes) - UINT8 n; - UINT8* ptr; - -+ if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) { -+ state->errcode = IMAGING_CODEC_OVERRUN; -+ return -1; -+ } -+ - ptr = buf; - - for (;;) { -diff --git a/src/libImaging/SgiRleDecode.c b/src/libImaging/SgiRleDecode.c -index 9d8e563..39e7b3a 100644 ---- a/src/libImaging/SgiRleDecode.c -+++ b/src/libImaging/SgiRleDecode.c -@@ -156,6 +156,11 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, - c->rlelength = c->lengthtab[c->rowno + c->channo * im->ysize]; - c->rleoffset -= SGI_HEADER_SIZE; - -+ if (c->rleoffset + c->rlelength > c->bufsize) { -+ state->errcode = IMAGING_CODEC_OVERRUN; -+ return -1; -+ } -+ - /* row decompression */ - if (c->bpc ==1) { - if(expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands)) --- -2.19.1 -