diff options
Diffstat (limited to 'meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch')
-rw-r--r-- | meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch b/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch new file mode 100644 index 0000000000..c1baf0e53a --- /dev/null +++ b/meta/recipes-qt/qt4/qt4-4.8.6/0036-Fixes-crash-in-gif-image-decoder.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | Upstream-Status: Backport | ||
2 | |||
3 | Backport patch to fix CVE-2015-1860 | ||
4 | |||
5 | http://code.qt.io/cgit/qt/qt.git/commit/?id=9f2425a | ||
6 | |||
7 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
8 | --- | ||
9 | From a1cf194c54be57d6ab55dfd26b9562a60532208e Mon Sep 17 00:00:00 2001 | ||
10 | From: Eirik Aavitsland <eirik.aavitsland@theqtcompany.com> | ||
11 | Date: Wed, 11 Mar 2015 09:00:41 +0100 | ||
12 | Subject: [PATCH] Fixes crash in gif image decoder | ||
13 | |||
14 | Fuzzing test revealed that for certain malformed gif files, | ||
15 | qgifhandler would segfault. | ||
16 | |||
17 | Change-Id: I5bb6f60e1c61849e0d8c735edc3869945e5331c1 | ||
18 | (cherry picked from qtbase/ea2c5417fcd374302f5019e67f72af5facbd29f6) | ||
19 | Reviewed-by: Richard J. Moore <rich@kde.org> | ||
20 | --- | ||
21 | src/gui/image/qgifhandler.cpp | 2 ++ | ||
22 | 1 file changed, 2 insertions(+) | ||
23 | |||
24 | diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp | ||
25 | index 5199dd3..49aa2a6 100644 | ||
26 | --- a/src/gui/image/qgifhandler.cpp | ||
27 | +++ b/src/gui/image/qgifhandler.cpp | ||
28 | @@ -944,6 +944,8 @@ void QGIFFormat::fillRect(QImage *image, int col, int row, int w, int h, QRgb co | ||
29 | |||
30 | void QGIFFormat::nextY(unsigned char *bits, int bpl) | ||
31 | { | ||
32 | + if (out_of_bounds) | ||
33 | + return; | ||
34 | int my; | ||
35 | switch (interlace) { | ||
36 | case 0: // Non-interlaced | ||
37 | -- | ||
38 | 2.4.1 | ||
39 | |||