rpms/giflib
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport fix for CVE-2022-28506

Browse Source
This commit is contained in:
Sandro Mani 2022-07-21 10:01:11 +02:00
parent 763a35cb09
commit 2e9917bf13
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
CVE-2022-28506.patch Normal file
View File

@ -0,0 +1,15 @@
diff -rupN giflib-5.2.1/gif2rgb.c giflib-5.2.1-new/gif2rgb.c
--- giflib-5.2.1/gif2rgb.c 2019-06-24 09:24:27.000000000 +0200
+++ giflib-5.2.1-new/gif2rgb.c 2022-07-21 09:58:28.256036156 +0200
@@ -294,6 +294,11 @@ static void DumpScreen2RGB(char *FileNam
GifRow = ScreenBuffer[i];
GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
for (j = 0, BufferP = Buffer; j < ScreenWidth; j++) {
+ /* Check if color is within color palete */
+ if (GifRow[j] >= ColorMap->ColorCount)
+ {
+ GIF_EXIT(GifErrorString(D_GIF_ERR_IMAGE_DEFECT));
+ }
ColorMapEntry = &ColorMap->Colors[GifRow[j]];
*BufferP++ = ColorMapEntry->Red;
*BufferP++ = ColorMapEntry->Green;

8
giflib.spec
View File

@ -1,7 +1,7 @@
Name: giflib Name: giflib
Summary: A library and utilities for processing GIFs Summary: A library and utilities for processing GIFs
Version: 5.2.1 Version: 5.2.1
Release: 13%{?dist} Release: 14%{?dist}
License: MIT License: MIT
URL: http://www.sourceforge.net/projects/%{name}/ URL: http://www.sourceforge.net/projects/%{name}/
@ -14,6 +14,9 @@ Patch0: giflib_quantize.patch
Patch1: giflib_coverity.patch Patch1: giflib_coverity.patch
# Generate HTML docs with consistent section IDs to avoid multilib difference # Generate HTML docs with consistent section IDs to avoid multilib difference
Patch2: giflib_html-docs-consistent-ids.patch Patch2: giflib_html-docs-consistent-ids.patch
# Backport fix for CVE-2022-28506
# See https://sourceforge.net/u/mmuzila/giflib/ci/5b74cdd9c1285514eaa4675347ba3eea81d32c65/
Patch3: CVE-2022-28506.patch
BuildRequires: cmake BuildRequires: cmake
BuildRequires: gcc BuildRequires: gcc
@ -145,6 +148,9 @@ rm -rf %{buildroot}%{mingw64_mandir}
%changelog %changelog
* Thu Jul 21 2022 Sandro Mani <manisandro@gmail.com> - 5.2.1-14
- Backport fix for CVE-2022-28506
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.1-13 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.1-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild