summaryrefslogtreecommitdiffstats
path: root/cups-CVE-2011-2896.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2011-12-27 16:50:50 +0100
committerRemi Collet <fedora@famillecollet.com>2011-12-27 16:50:50 +0100
commit65608e0f8bbc0190cc1b7646f653e796c807f02b (patch)
tree274ade8f5007bd7f9c252d8262637e0300363e82 /cups-CVE-2011-2896.patch
import cups from F16
Diffstat (limited to 'cups-CVE-2011-2896.patch')
-rw-r--r--cups-CVE-2011-2896.patch33
1 files changed, 33 insertions, 0 deletions
diff --git a/cups-CVE-2011-2896.patch b/cups-CVE-2011-2896.patch
new file mode 100644
index 0000000..a949b9d
--- /dev/null
+++ b/cups-CVE-2011-2896.patch
@@ -0,0 +1,33 @@
+diff -up cups-1.4.8/filter/image-gif.c.CVE-2011-2896 cups-1.4.8/filter/image-gif.c
+--- cups-1.4.8/filter/image-gif.c.CVE-2011-2896 2011-06-20 21:37:51.000000000 +0100
++++ cups-1.4.8/filter/image-gif.c 2011-08-19 11:33:37.547911212 +0100
+@@ -648,11 +648,13 @@ gif_read_lzw(FILE *fp, /* I - File to
+
+ if (code == max_code)
+ {
+- *sp++ = firstcode;
+- code = oldcode;
++ if (sp < (stack + 8192))
++ *sp++ = firstcode;
++
++ code = oldcode;
+ }
+
+- while (code >= clear_code)
++ while (code >= clear_code && sp < (stack + 8192))
+ {
+ *sp++ = table[1][code];
+ if (code == table[0][code])
+@@ -661,8 +663,10 @@ gif_read_lzw(FILE *fp, /* I - File to
+ code = table[0][code];
+ }
+
+- *sp++ = firstcode = table[1][code];
+- code = max_code;
++ if (sp < (stack + 8192))
++ *sp++ = firstcode = table[1][code];
++
++ code = max_code;
+
+ if (code < 4096)
+ {