1a03b9047c
- Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 Resolves: RHEL-223940
48 lines
1.3 KiB
Diff
48 lines
1.3 KiB
Diff
From 3d3d3d57c590a498b0939e78df64a1a5dbac17bc Mon Sep 17 00:00:00 2001
|
|
From: Ilija Tovilo <ilija.tovilo@me.com>
|
|
Date: Tue, 28 Jul 2026 02:48:11 +0200
|
|
Subject: [PATCH 1/5] libgd patch for CVE-2026-9672
|
|
|
|
Patch by Pierre Joye (pierrejoye).
|
|
|
|
(cherry picked from commit fcd691b377d02285740744bee17c0f298be227d5)
|
|
(cherry picked from commit 629e049847acec53b905b4aceba829a0c85f0995)
|
|
---
|
|
ext/gd/libgd/gd_gif_in.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
|
index 1f69723610..e055f90244 100644
|
|
--- a/ext/gd/libgd/gd_gif_in.c
|
|
+++ b/ext/gd/libgd/gd_gif_in.c
|
|
@@ -450,7 +450,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
|
|
sd->table[1][i] = i;
|
|
}
|
|
for (; i < (1<<MAX_LWZ_BITS); ++i)
|
|
- sd->table[0][i] = sd->table[1][0] = 0;
|
|
+ sd->table[0][i] = sd->table[1][i] = 0;
|
|
|
|
sd->sp = sd->stack;
|
|
|
|
@@ -494,6 +494,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
|
|
|
|
if (count != 0)
|
|
return -2;
|
|
+
|
|
+ return -2;
|
|
}
|
|
|
|
incode = code;
|
|
@@ -560,7 +562,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
|
|
int v;
|
|
int xpos = 0, ypos = 0, pass = 0;
|
|
int i;
|
|
- LZW_STATIC_DATA sd;
|
|
+ LZW_STATIC_DATA sd = {0};
|
|
|
|
|
|
/*
|
|
--
|
|
2.55.0
|
|
|