diff options
Diffstat (limited to 'media-libs/libjpeg-turbo/files/libjpeg-turbo-1.5.3-divzero_fix.patch')
| -rw-r--r-- | media-libs/libjpeg-turbo/files/libjpeg-turbo-1.5.3-divzero_fix.patch | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/media-libs/libjpeg-turbo/files/libjpeg-turbo-1.5.3-divzero_fix.patch b/media-libs/libjpeg-turbo/files/libjpeg-turbo-1.5.3-divzero_fix.patch new file mode 100644 index 000000000000..c7e6d1056769 --- /dev/null +++ b/media-libs/libjpeg-turbo/files/libjpeg-turbo-1.5.3-divzero_fix.patch @@ -0,0 +1,18 @@ +Backported from +https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6 + +--- libjpeg-turbo-1.5.3/rdbmp.c ++++ libjpeg-turbo-1.5.3/rdbmp.c +@@ -434,6 +434,12 @@ + progress->total_extra_passes++; /* count file input as separate pass */ + } + ++ /* Ensure that biWidth * cinfo->input_components doesn't exceed the maximum ++ value of the JDIMENSION type. This is only a danger with BMP files, since ++ their width and height fields are 32-bit integers. */ ++ if ((unsigned long long)biWidth * ++ (unsigned long long)cinfo->input_components > 0xFFFFFFFFULL) ++ ERREXIT(cinfo, JERR_WIDTH_OVERFLOW); + /* Allocate one-row buffer for returned data */ + source->pub.buffer = (*cinfo->mem->alloc_sarray) + ((j_common_ptr) cinfo, JPOOL_IMAGE, |