diff options
author | Pacho Ramos <pacho@gentoo.org> | 2015-11-14 12:17:58 +0100 |
---|---|---|
committer | Pacho Ramos <pacho@gentoo.org> | 2015-11-14 14:45:43 +0100 |
commit | f3cd6a4f3dfbd9647cf086b2f465c45517616593 (patch) | |
tree | 05f6cc41a91d563a0644afb8e4a072d8a73c55cf /x11-libs/gdk-pixbuf | |
parent | e3608acdf383e5cf79aacf58231de53ca4fedad8 (diff) | |
download | gentoo-f3cd6a4f3dfbd9647cf086b2f465c45517616593.tar.gz gentoo-f3cd6a4f3dfbd9647cf086b2f465c45517616593.tar.xz |
x11-libs/gdk-pixbuf: Drop old
Package-Manager: portage-2.2.24
Diffstat (limited to 'x11-libs/gdk-pixbuf')
11 files changed, 1 insertions, 610 deletions
diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-divide-by-zero.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-divide-by-zero.patch deleted file mode 100644 index 7881e6580ac..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-divide-by-zero.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 74c418ba2e41ab9e2287420378a6192788b1fab6 Mon Sep 17 00:00:00 2001 -From: Sarita Rawat <sarita.rawat@samsung.com> -Date: Fri, 5 Jun 2015 06:56:00 +0000 -Subject: [PATCH] Avoid a possible divide-by-zero - -Pointed out in - -https://bugzilla.gnome.org/show_bug.cgi?id=750440 ---- - gdk-pixbuf/gdk-pixbuf-loader.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gdk-pixbuf/gdk-pixbuf-loader.c b/gdk-pixbuf/gdk-pixbuf-loader.c -index 65845ed..668b703 100644 ---- a/gdk-pixbuf/gdk-pixbuf-loader.c -+++ b/gdk-pixbuf/gdk-pixbuf-loader.c -@@ -330,7 +330,7 @@ gdk_pixbuf_loader_prepare (GdkPixbuf *pixbuf, - else - anim = gdk_pixbuf_non_anim_new (pixbuf); - -- if (priv->needs_scale) { -+ if (priv->needs_scale && width != 0 && height != 0) { - priv->animation = GDK_PIXBUF_ANIMATION (_gdk_pixbuf_scaled_anim_new (anim, - (double) priv->width / width, - (double) priv->height / height, --- -2.5.0 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-pixops-overflow.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-pixops-overflow.patch deleted file mode 100644 index 22a3c25508c..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.30.8-pixops-overflow.patch +++ /dev/null @@ -1,85 +0,0 @@ -From ffec86ed5010c5a2be14f47b33bcf4ed3169a199 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 13 Jul 2015 00:33:40 -0400 -Subject: [PATCH] pixops: Be more careful about integer overflow - -Our loader code is supposed to handle out-of-memory and overflow -situations gracefully, reporting errors instead of aborting. But -if you load an image at a specific size, we also execute our -scaling code, which was not careful enough about overflow in some -places. - -This commit makes the scaling code silently return if it fails to -allocate filter tables. This is the best we can do, since -gdk_pixbuf_scale() is not taking a GError. - -https://bugzilla.gnome.org/show_bug.cgi?id=752297 ---- - gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++----- - 1 file changed, 17 insertions(+), 5 deletions(-) - -diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c -index 29a1c14..ce51745 100644 ---- a/gdk-pixbuf/pixops/pixops.c -+++ b/gdk-pixbuf/pixops/pixops.c -@@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter) - int i_offset, j_offset; - int n_x = filter->x.n; - int n_y = filter->y.n; -- int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y); -+ gsize n_weights; -+ int *weights; -+ -+ n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y; -+ if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y) -+ return NULL; /* overflow, bail */ -+ -+ weights = g_try_new (int, n_weights); -+ if (!weights) -+ return NULL; /* overflow, bail */ - - for (i_offset=0; i_offset < SUBSAMPLE; i_offset++) - for (j_offset=0; j_offset < SUBSAMPLE; j_offset++) -@@ -1347,8 +1356,11 @@ pixops_process (guchar *dest_buf, - if (x_step == 0 || y_step == 0) - return; /* overflow, bail out */ - -- line_bufs = g_new (guchar *, filter->y.n); - filter_weights = make_filter_table (filter); -+ if (!filter_weights) -+ return; /* overflow, bail out */ -+ -+ line_bufs = g_new (guchar *, filter->y.n); - - check_shift = check_size ? get_check_shift (check_size) : 0; - -@@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim, - double scale) - { - int n = ceil (1 / scale + 1); -- double *pixel_weights = g_new (double, SUBSAMPLE * n); -+ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); - int offset; - int i; - -@@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension *dim, - } - - dim->n = n; -- dim->weights = g_new (double, SUBSAMPLE * n); -+ dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); - - pixel_weights = dim->weights; - -@@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim, - double scale) - { - int n = ceil (1/scale + 3.0); -- double *pixel_weights = g_new (double, SUBSAMPLE * n); -+ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n); - double w; - int offset, i; - --- -2.5.0 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.5-pixops-overflow.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.5-pixops-overflow.patch deleted file mode 100644 index 6f28dfde29a..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.5-pixops-overflow.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 8dba67cb4f38d62a47757741ad41e3f245b4a32a Mon Sep 17 00:00:00 2001 -From: Benjamin Otte <otte@redhat.com> -Date: Mon, 17 Aug 2015 18:52:47 +0200 -Subject: [PATCH] pixops: Fix oversight for CVE-2015-4491 - -The n_x variable could be made large enough to overflow, too. - -Also included are various testcases for this vulnerability: -- The original exploit (adapted for the testsuite) -- Causing overflow by making both X and Y variables large -- Causing overflow using only the X variable -- Causing overflow using only the Y variable - -https://bugzilla.gnome.org/show_bug.cgi?id=752297 ---- - gdk-pixbuf/pixops/pixops.c | 6 ++- - 1 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c -index ce51745..7f2cbff 100644 ---- a/gdk-pixbuf/pixops/pixops.c -+++ b/gdk-pixbuf/pixops/pixops.c -@@ -1275,7 +1275,11 @@ make_filter_table (PixopsFilter *filter) - gsize n_weights; - int *weights; - -- n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y; -+ n_weights = SUBSAMPLE * SUBSAMPLE * n_x; -+ if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x) -+ return NULL; /* overflow, bail */ -+ -+ n_weights *= n_y; - if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y) - return NULL; /* overflow, bail */ - --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-alpha-overflow-rebased.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-alpha-overflow-rebased.patch deleted file mode 100644 index 647dd591389..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-alpha-overflow-rebased.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 2937faff06629e224f113a9af73eba59f65c3845 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 24 Aug 2015 15:20:08 -0400 -Subject: [PATCH] Avoid integer overflow in gdk_pixbuf_add_alpha - -Same as before: don't do ptr = base + y * rowstride if y and -rowstride are integers. - -This should fix http://bugzilla.gnome/org/753569 ---- - gdk-pixbuf/gdk-pixbuf-util.c | 23 +++++++++++++++-------- - 1 file changed, 15 insertions(+), 8 deletions(-) - -diff --git a/gdk-pixbuf/gdk-pixbuf-util.c b/gdk-pixbuf/gdk-pixbuf-util.c -index 6fbaa8e..6eea4c3 100644 ---- a/gdk-pixbuf/gdk-pixbuf-util.c -+++ b/gdk-pixbuf/gdk-pixbuf-util.c -@@ -65,12 +65,18 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, - { - GdkPixbuf *new_pixbuf; - int x, y; -+ const guint8 *src_pixels; -+ guint8 *ret_pixels; -+ const guchar *src; -+ guchar *dest; - - g_return_val_if_fail (GDK_IS_PIXBUF (pixbuf), NULL); - g_return_val_if_fail (pixbuf->colorspace == GDK_COLORSPACE_RGB, NULL); - g_return_val_if_fail (pixbuf->n_channels == 3 || pixbuf->n_channels == 4, NULL); - g_return_val_if_fail (pixbuf->bits_per_sample == 8, NULL); - -+ src_pixels = pixbuf->pixels; -+ - if (pixbuf->has_alpha) { - new_pixbuf = gdk_pixbuf_copy (pixbuf); - if (!new_pixbuf) -@@ -81,17 +87,18 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, - } else { - new_pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, pixbuf->width, pixbuf->height); - } -- -+ - if (!new_pixbuf) - return NULL; - -- for (y = 0; y < pixbuf->height; y++) { -- guchar *src, *dest; -+ ret_pixels = new_pixbuf->pixels; -+ -+ for (y = 0; y < pixbuf->height; y++, src_pixels += pixbuf->rowstride, ret_pixels += new_pixbuf->rowstride) { - guchar tr, tg, tb; - -- src = pixbuf->pixels + y * pixbuf->rowstride; -- dest = new_pixbuf->pixels + y * new_pixbuf->rowstride; -- -+ src = src_pixels; -+ dest = ret_pixels; -+ - if (pixbuf->has_alpha) { - /* Just subst color, we already copied everything else */ - for (x = 0; x < pixbuf->width; x++) { -@@ -100,12 +107,12 @@ gdk_pixbuf_add_alpha (const GdkPixbuf *pixbuf, - src += 4; - dest += 4; - } -- } else { -+ } else { - for (x = 0; x < pixbuf->width; x++) { - tr = *dest++ = *src++; - tg = *dest++ = *src++; - tb = *dest++ = *src++; -- -+ - if (substitute_color && tr == r && tg == g && tb == b) - *dest++ = 0; - else --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-jpeg-overflow.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-jpeg-overflow.patch deleted file mode 100644 index ebec196c4f9..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-jpeg-overflow.patch +++ /dev/null @@ -1,35 +0,0 @@ -From fde8d1d12a32740770253e97ddc9602654e16865 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 24 Aug 2015 15:48:51 -0400 -Subject: [PATCH] jpeg: Fix some integer overflows - -Similar to the previous commit. ---- - gdk-pixbuf/io-jpeg.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c -index fa6bec1..eb48aed 100644 ---- a/gdk-pixbuf/io-jpeg.c -+++ b/gdk-pixbuf/io-jpeg.c -@@ -886,7 +886,7 @@ gdk_pixbuf__jpeg_image_load_lines (JpegProgContext *context, - return FALSE; - } - -- context->dptr += nlines * context->pixbuf->rowstride; -+ context->dptr += (gsize)nlines * context->pixbuf->rowstride; - - /* send updated signal */ - if (context->updated_func) -@@ -1494,7 +1494,7 @@ real_save_jpeg (GdkPixbuf *pixbuf, - while (cinfo.next_scanline < cinfo.image_height) { - /* convert scanline from ARGB to RGB packed */ - for (j = 0; j < w; j++) -- memcpy (&(buf[j*3]), &(ptr[i*rowstride + j*n_channels]), 3); -+ memcpy (&(buf[j*3]), &(ptr[(gsize)i*rowstride + j*n_channels]), 3); - - /* write scanline */ - jbuf = (JSAMPROW *)(&buf); --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-gcc-optimizer.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-gcc-optimizer.patch deleted file mode 100644 index bd957b79cd2..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-gcc-optimizer.patch +++ /dev/null @@ -1,46 +0,0 @@ -From dd4b061c27dc0865c8f8987d294de6e04b321c18 Mon Sep 17 00:00:00 2001 -From: Benjamin Otte <otte@redhat.com> -Date: Sat, 22 Aug 2015 23:06:23 +0200 -Subject: [PATCH] pixops: Be smarter than gcc's optimizer - -gcc realizes that the overflow checks aren't necessary. Why not? - -Well, if an int overflows, the behavior is undefined. And turning on --fomit-instructions is valid behavior in an undefined situation. ---- - gdk-pixbuf/pixops/pixops.c | 15 +++++++-------- - 1 file changed, 7 insertions(+), 8 deletions(-) - -diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c -index b7951c7..5564a40 100644 ---- a/gdk-pixbuf/pixops/pixops.c -+++ b/gdk-pixbuf/pixops/pixops.c -@@ -1272,18 +1272,17 @@ make_filter_table (PixopsFilter *filter) - int i_offset, j_offset; - int n_x = filter->x.n; - int n_y = filter->y.n; -- int n_weights; - int *weights; - -- n_weights = SUBSAMPLE * SUBSAMPLE * n_x; -- if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x) -- return NULL; /* overflow, bail */ -+ /* check n_x doesn't overflow */ -+ if (G_MAXINT / (SUBSAMPLE * SUBSAMPLE) < n_x) -+ return NULL; - -- n_weights *= n_y; -- if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y) -- return NULL; /* overflow, bail */ -+ /* check n_y doesn't overflow */ -+ if (G_MAXINT / (SUBSAMPLE * SUBSAMPLE * n_x) < n_y) -+ return NULL; - -- weights = g_try_new (int, n_weights); -+ weights = g_try_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y); - if (!weights) - return NULL; /* overflow, bail */ - --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-overflow-rebased.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-overflow-rebased.patch deleted file mode 100644 index cb94784246e..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-overflow-rebased.patch +++ /dev/null @@ -1,162 +0,0 @@ -From 6df428ba24d8f244d08c4a205053e26b28cee0a9 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 24 Aug 2015 14:44:50 -0400 -Subject: [PATCH] Fix some more integer overflows - -The scaling code had a similar problem to the one fixed in the -previous commit: Expressions like ptr = base + y * rowstride are -prone to overflow if y and rowstride are (possibly large) integers. ---- - gdk-pixbuf/pixops/pixops.c | 44 ++++++++++++++++++++++---------------------- - 1 file changed, 22 insertions(+), 22 deletions(-) - -diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c -index 993223e..33aa32e 100644 ---- a/gdk-pixbuf/pixops/pixops.c -+++ b/gdk-pixbuf/pixops/pixops.c -@@ -304,8 +304,8 @@ pixops_scale_nearest (guchar *dest_buf, - guchar *dest; - y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT; - y_pos = CLAMP (y_pos, 0, src_height - 1); -- src = src_buf + y_pos * src_rowstride; -- dest = dest_buf + i * dest_rowstride; -+ src = src_buf + (gsize)y_pos * src_rowstride; -+ dest = dest_buf + (gsize)i * dest_rowstride; - - x = render_x0 * x_step + x_step / 2; - -@@ -368,8 +368,8 @@ pixops_composite_nearest (guchar *dest_buf, - guchar *dest; - y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT; - y_pos = CLAMP (y_pos, 0, src_height - 1); -- src = src_buf + y_pos * src_rowstride; -- dest = dest_buf + i * dest_rowstride; -+ src = src_buf + (gsize)y_pos * src_rowstride; -+ dest = dest_buf + (gsize)i * dest_rowstride; - - x = render_x0 * x_step + x_step / 2; - -@@ -460,8 +460,8 @@ pixops_composite_color_nearest (guchar *dest_buf, - guchar *dest; - y_pos = ((i + render_y0) * y_step + y_step / 2) >> SCALE_SHIFT; - y_pos = CLAMP (y_pos, 0, src_height - 1); -- src = src_buf + y_pos * src_rowstride; -- dest = dest_buf + i * dest_rowstride; -+ src = src_buf + (gsize)y_pos * src_rowstride; -+ dest = dest_buf + (gsize)i * dest_rowstride; - - x = render_x0 * x_step + x_step / 2; - -@@ -1303,7 +1303,7 @@ pixops_process (guchar *dest_buf, - guchar *new_outbuf; - guint32 tcolor1, tcolor2; - -- guchar *outbuf = dest_buf + dest_rowstride * i; -+ guchar *outbuf = dest_buf + (gsize)dest_rowstride * i; - guchar *outbuf_end = outbuf + dest_channels * (render_x1 - render_x0); - - if (((i + check_y) >> check_shift) & 1) -@@ -1322,9 +1322,9 @@ pixops_process (guchar *dest_buf, - if (y_start < 0) - line_bufs[j] = (guchar *)src_buf; - else if (y_start < src_height) -- line_bufs[j] = (guchar *)src_buf + src_rowstride * y_start; -+ line_bufs[j] = (guchar *)src_buf + (gsize)src_rowstride * y_start; - else -- line_bufs[j] = (guchar *)src_buf + src_rowstride * (src_height - 1); -+ line_bufs[j] = (guchar *)src_buf + (gsize)src_rowstride * (src_height - 1); - - y_start++; - } -@@ -1348,7 +1348,7 @@ pixops_process (guchar *dest_buf, - } - - new_outbuf = (*line_func) (run_weights, filter->x.n, filter->y.n, -- outbuf, dest_x, dest_buf + dest_rowstride * -+ outbuf, dest_x, dest_buf + (gsize)dest_rowstride * - i + run_end_index * dest_channels, - dest_channels, dest_has_alpha, - line_bufs, src_channels, src_has_alpha, -@@ -1866,7 +1866,7 @@ _pixops_composite (guchar *dest_buf, - return; - #endif - -- new_dest_buf = dest_buf + dest_y * dest_rowstride + dest_x * dest_channels; -+ new_dest_buf = dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * dest_channels; - render_x0 = dest_x - offset_x; - render_y0 = dest_y - offset_y; - render_x1 = dest_x + dest_region_width - offset_x; -@@ -2026,7 +2026,7 @@ pixops_medialib_composite (guchar *dest_buf, - if (!use_medialib) - { - /* Use non-mediaLib version */ -- _pixops_composite_real (dest_buf + dest_y * dest_rowstride + dest_x * -+ _pixops_composite_real (dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * - dest_channels, dest_x - offset_x, dest_y - - offset_y, dest_x + dest_region_width - offset_x, - dest_y + dest_region_height - offset_y, -@@ -2068,8 +2068,8 @@ pixops_medialib_composite (guchar *dest_buf, - } - else - { -- mlib_u8 *data = dest_buf + (dest_y * dest_rowstride) + -- (dest_x * dest_channels); -+ mlib_u8 *data = dest_buf + (gsize)dest_y * dest_rowstride + -+ (gsize)dest_x * dest_channels; - - mlib_ImageSetStruct (&img_dest, MLIB_BYTE, dest_channels, - dest_region_width, dest_region_height, -@@ -2136,8 +2136,8 @@ pixops_medialib_composite (guchar *dest_buf, - else - { - /* Should not happen - Use non-mediaLib version */ -- _pixops_composite_real (dest_buf + dest_y * dest_rowstride + -- dest_x * dest_channels, -+ _pixops_composite_real (dest_buf + (gsize)dest_y * dest_rowstride + -+ (gsize)dest_x * dest_channels, - dest_x - offset_x, dest_y - offset_y, - dest_x + dest_region_width - offset_x, - dest_y + dest_region_height - offset_y, -@@ -2260,7 +2260,7 @@ _pixops_scale (guchar *dest_buf, - return; - #endif - -- new_dest_buf = dest_buf + dest_y * dest_rowstride + dest_x * dest_channels; -+ new_dest_buf = dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * dest_channels; - render_x0 = dest_x - offset_x; - render_y0 = dest_y - offset_y; - render_x1 = dest_x + dest_region_width - offset_x; -@@ -2314,8 +2314,8 @@ pixops_medialib_scale (guchar *dest_buf, - */ - if (!use_medialib) - { -- _pixops_scale_real (dest_buf + dest_y * dest_rowstride + dest_x * -- dest_channels, dest_x - offset_x, dest_y - offset_y, -+ _pixops_scale_real (dest_buf + (gsize)dest_y * dest_rowstride + (gsize)dest_x * -+ dest_channels, dest_x - offset_x, dest_y - offset_y, - dest_x + dest_region_width - offset_x, - dest_y + dest_region_height - offset_y, - dest_rowstride, dest_channels, dest_has_alpha, -@@ -2343,8 +2343,8 @@ pixops_medialib_scale (guchar *dest_buf, - } - else - { -- mlib_u8 *data = dest_buf + (dest_y * dest_rowstride) + -- (dest_x * dest_channels); -+ mlib_u8 *data = dest_buf + (gsize)dest_y * dest_rowstride + -+ (gsize)dest_x * dest_channels; - - mlib_ImageSetStruct (&img_dest, MLIB_BYTE, dest_channels, - dest_region_width, dest_region_height, -@@ -2379,7 +2379,7 @@ pixops_medialib_scale (guchar *dest_buf, - int channels = 3; - int rowstride = (channels * src_width + 3) & ~3; - -- tmp_buf = g_malloc (src_rowstride * src_height); -+ tmp_buf = g_malloc_n (src_rowstride, src_height); - - if (src_buf != NULL) - { --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-variable-type.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-variable-type.patch deleted file mode 100644 index a83535f405b..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-pixops-variable-type.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 3df91dc6c6f8d1421e9c8756959280de792af77a Mon Sep 17 00:00:00 2001 -From: Benjamin Otte <otte@redhat.com> -Date: Sat, 22 Aug 2015 17:57:23 +0200 -Subject: [PATCH] pixops: Chane variable type - -n_weights is used to do overflow checks. So by reducing the size to 32 -bits signed we overflow earlier. This is necessary because further down -the code lots of code uses int variables to iterate over this variable -and we don't want those to overflow. - -The correct fix would be to make all those variables gsize too, but -that's way more invasive and requires different checks in different -places so I'm not gonna do that now. -And as long as scale factors are not expected to reach G_MAXINT it's not -really necessary to do this change anyway. - -https://bugzilla.gnome.org/show_bug.cgi?id=753908 ---- - gdk-pixbuf/pixops/pixops.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c -index 7f2cbff..b7951c7 100644 ---- a/gdk-pixbuf/pixops/pixops.c -+++ b/gdk-pixbuf/pixops/pixops.c -@@ -1272,7 +1272,7 @@ make_filter_table (PixopsFilter *filter) - int i_offset, j_offset; - int n_x = filter->x.n; - int n_y = filter->y.n; -- gsize n_weights; -+ int n_weights; - int *weights; - - n_weights = SUBSAMPLE * SUBSAMPLE * n_x; --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-png-overflow.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-png-overflow.patch deleted file mode 100644 index 83c67b5cb8b..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-png-overflow.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 8714ab407c54d5989d15a78eb15550c2d52d95b8 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 24 Aug 2015 14:13:37 -0400 -Subject: [PATCH] png: Fix some integer overflows - -The png loader was not careful enough in some places. Width * height -can overflow an integer. - -This should fix http://bugzilla.gnome.org/734556. ---- - gdk-pixbuf/io-png.c | 15 ++++++++------- - 1 file changed, 8 insertions(+), 7 deletions(-) - -diff --git a/gdk-pixbuf/io-png.c b/gdk-pixbuf/io-png.c -index 3336b1e..5690875 100644 ---- a/gdk-pixbuf/io-png.c -+++ b/gdk-pixbuf/io-png.c -@@ -267,6 +267,7 @@ gdk_pixbuf__png_image_load (FILE *f, GError **error) - gchar *density_str; - guint32 retval; - gint compression_type; -+ gpointer ptr; - - #ifdef PNG_USER_MEM_SUPPORTED - png_ptr = png_create_read_struct_2 (PNG_LIBPNG_VER_STRING, -@@ -326,8 +327,8 @@ gdk_pixbuf__png_image_load (FILE *f, GError **error) - - rows = g_new (png_bytep, h); - -- for (i = 0; i < h; i++) -- rows[i] = pixbuf->pixels + i * pixbuf->rowstride; -+ for (i = 0, ptr = pixbuf->pixels; i < h; i++, ptr += pixbuf->rowstride) -+ rows[i] = ptr; - - png_read_image (png_ptr, rows); - png_read_end (png_ptr, info_ptr); -@@ -745,6 +746,7 @@ png_row_callback (png_structp png_read_ptr, - { - LoadContext* lc; - guchar* old_row = NULL; -+ gsize rowstride; - - lc = png_get_progressive_ptr(png_read_ptr); - -@@ -770,8 +772,9 @@ png_row_callback (png_structp png_read_ptr, - lc->max_row_seen_in_chunk = MAX(lc->max_row_seen_in_chunk, ((gint)row_num)); - lc->last_row_seen_in_chunk = row_num; - lc->last_pass_seen_in_chunk = pass_num; -- -- old_row = lc->pixbuf->pixels + (row_num * lc->pixbuf->rowstride); -+ -+ rowstride = lc->pixbuf->rowstride; -+ old_row = lc->pixbuf->pixels + (row_num * rowstride); - - png_progressive_combine_row(lc->png_read_ptr, old_row, new_row); - } -@@ -1123,11 +1126,9 @@ static gboolean real_save_png (GdkPixbuf *pixbuf, - png_set_shift (png_ptr, &sig_bit); - png_set_packing (png_ptr); - -- ptr = pixels; -- for (y = 0; y < h; y++) { -+ for (y = 0, ptr = pixels; y < h; y++, ptr += rowstride) { - row_ptr = (png_bytep)ptr; - png_write_rows (png_ptr, &row_ptr, 1); -- ptr += rowstride; - } - - png_write_end (png_ptr, info_ptr); --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-rotate-overflow.patch b/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-rotate-overflow.patch deleted file mode 100644 index fa6b90cea74..00000000000 --- a/x11-libs/gdk-pixbuf/files/gdk-pixbuf-2.31.6-rotate-overflow.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 4f68cb78a5277f169b9531e6998c00c7976594e4 Mon Sep 17 00:00:00 2001 -From: Matthias Clasen <mclasen@redhat.com> -Date: Mon, 24 Aug 2015 15:29:36 -0400 -Subject: [PATCH] Avoid integer overflow in gdk_pixbuf_rotate_simple - -Same as before: don't do ptr = base + y * rowstride if y and -rowstride are integers. ---- - gdk-pixbuf/gdk-pixbuf-scale.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gdk-pixbuf/gdk-pixbuf-scale.c b/gdk-pixbuf/gdk-pixbuf-scale.c -index 4288c65..475126a 100644 ---- a/gdk-pixbuf/gdk-pixbuf-scale.c -+++ b/gdk-pixbuf/gdk-pixbuf-scale.c -@@ -396,7 +396,7 @@ gdk_pixbuf_composite_color_simple (const GdkPixbuf *src, - return dest; - } - --#define OFFSET(pb, x, y) ((x) * (pb)->n_channels + (y) * (pb)->rowstride) -+#define OFFSET(pb, x, y) ((x) * (pb)->n_channels + (gsize)(y) * (pb)->rowstride) - - /** - * gdk_pixbuf_rotate_simple: --- -2.5.1 - diff --git a/x11-libs/gdk-pixbuf/metadata.xml b/x11-libs/gdk-pixbuf/metadata.xml index 6e0e2ecb48c..da6fd63d008 100644 --- a/x11-libs/gdk-pixbuf/metadata.xml +++ b/x11-libs/gdk-pixbuf/metadata.xml @@ -1,5 +1,5 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> <pkgmetadata> - <herd>gnome</herd> +<herd>gnome</herd> </pkgmetadata> |