summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch')
-rw-r--r--meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch48
1 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch b/meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch
new file mode 100644
index 0000000000..2622630d10
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/libpng-1.6.13/CVE-2015-8126_4.patch
@@ -0,0 +1,48 @@
1From 83f4c735c88e7f451541c1528d8043c31ba3b466 Mon Sep 17 00:00:00 2001
2From: Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
3Date: Thu, 5 Nov 2015 11:18:44 -0600
4Subject: [PATCH] [libpng16] Clean up coding style in png_handle_PLTE()
5
6Upstream-Status: Backport
7https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466
8
9CVE: CVE-2015-8126 patch #4
10Signed-off-by: Armin Kuster <akuster@mvista.com>
11
12---
13 pngrutil.c | 17 ++++++++++-------
14 1 file changed, 10 insertions(+), 7 deletions(-)
15
16Index: libpng-1.6.17/pngrutil.c
17===================================================================
18--- libpng-1.6.17.orig/pngrutil.c
19+++ libpng-1.6.17/pngrutil.c
20@@ -925,18 +925,21 @@ png_handle_PLTE(png_structrp png_ptr, pn
21 return;
22 }
23
24- max_palette_length = (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE) ?
25- (1 << png_ptr->bit_depth) : PNG_MAX_PALETTE_LENGTH;
26-
27 /* The cast is safe because 'length' is less than 3*PNG_MAX_PALETTE_LENGTH */
28 num = (int)length / 3;
29
30- /* If the palette has 256 or fewer entries but is too large for the bit depth,
31- * we don't issue an error, to preserve the behavior of previous libpng versions.
32- * We silently truncate the unused extra palette entries here.
33+ /* If the palette has 256 or fewer entries but is too large for the bit
34+ * depth, we don't issue an error, to preserve the behavior of previous
35+ * libpng versions. We silently truncate the unused extra palette entries
36+ * here.
37 */
38+ if (png_ptr->color_type == PNG_COLOR_TYPE_PALETTE)
39+ max_palette_length = (1 << png_ptr->bit_depth);
40+ else
41+ max_palette_length = PNG_MAX_PALETTE_LENGTH;
42+
43 if (num > max_palette_length)
44- num = max_palette_length;
45+ num = max_palette_length;
46
47 #ifdef PNG_POINTER_INDEXING_SUPPORTED
48 for (i = 0, pal_ptr = palette; i < num; i++, pal_ptr++)