import CS pixman-0.38.4-4.el8
This commit is contained in:
parent
b8f92299cc
commit
92aec859e8
|
|
@ -0,0 +1,29 @@
|
|||
From a1f88e842e0216a5b4df1ab023caebe33c101395 Mon Sep 17 00:00:00 2001
|
||||
From: Matt Turner <mattst88@gmail.com>
|
||||
Date: Wed, 2 Nov 2022 12:07:32 -0400
|
||||
Subject: [PATCH] Avoid integer overflow leading to out-of-bounds write
|
||||
|
||||
Thanks to Maddie Stone and Google's Project Zero for discovering this
|
||||
issue, providing a proof-of-concept, and a great analysis.
|
||||
|
||||
Closes: https://gitlab.freedesktop.org/pixman/pixman/-/issues/63
|
||||
---
|
||||
pixman/pixman-trap.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/pixman/pixman-trap.c b/pixman/pixman-trap.c
|
||||
index 91766fd..7560405 100644
|
||||
--- a/pixman/pixman-trap.c
|
||||
+++ b/pixman/pixman-trap.c
|
||||
@@ -74,7 +74,7 @@ pixman_sample_floor_y (pixman_fixed_t y,
|
||||
|
||||
if (f < Y_FRAC_FIRST (n))
|
||||
{
|
||||
- if (pixman_fixed_to_int (i) == 0x8000)
|
||||
+ if (pixman_fixed_to_int (i) == 0xffff8000)
|
||||
{
|
||||
f = 0; /* saturate */
|
||||
}
|
||||
--
|
||||
2.41.0
|
||||
|
||||
|
|
@ -0,0 +1,84 @@
|
|||
From 8256c235d9b3854d039242356905eca854a890ba Mon Sep 17 00:00:00 2001
|
||||
From: Basile Clement <basile-pixman@clement.pm>
|
||||
Date: Tue, 9 Apr 2019 23:16:13 +0200
|
||||
Subject: [PATCH] Fix bilinear filter computation in wide pipeline
|
||||
|
||||
The recently introduced wide pipeline for filters has a typo which
|
||||
causes it to improperly compute bilinear interpolation positions,
|
||||
causing various glitches when enabled.
|
||||
|
||||
This patch uses the proper computation for bilinear interpolation in the
|
||||
wide pipeline. It also makes related `if` statements conformant to the
|
||||
CODING_STYLE:
|
||||
|
||||
* If a substatement spans multiple lines, then there must be braces
|
||||
around it.
|
||||
|
||||
* If one substatement of an if statement has braces, then the other
|
||||
must too.
|
||||
|
||||
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
|
||||
---
|
||||
pixman/pixman-bits-image.c | 9 +++++++++
|
||||
pixman/pixman-inlines.h | 2 +-
|
||||
2 files changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/pixman/pixman-bits-image.c b/pixman/pixman-bits-image.c
|
||||
index 564789e..7bc2ba8 100644
|
||||
--- a/pixman/pixman-bits-image.c
|
||||
+++ b/pixman/pixman-bits-image.c
|
||||
@@ -432,29 +432,38 @@ bits_image_fetch_pixel_filtered (bits_image_t *image,
|
||||
|
||||
case PIXMAN_FILTER_CONVOLUTION:
|
||||
if (wide)
|
||||
+ {
|
||||
bits_image_fetch_pixel_convolution (image, x, y,
|
||||
get_pixel, out,
|
||||
accum_float,
|
||||
reduce_float);
|
||||
+ }
|
||||
else
|
||||
+ {
|
||||
bits_image_fetch_pixel_convolution (image, x, y,
|
||||
get_pixel, out,
|
||||
accum_32, reduce_32);
|
||||
+ }
|
||||
break;
|
||||
|
||||
case PIXMAN_FILTER_SEPARABLE_CONVOLUTION:
|
||||
if (wide)
|
||||
+ {
|
||||
bits_image_fetch_pixel_separable_convolution (image, x, y,
|
||||
get_pixel, out,
|
||||
accum_float,
|
||||
reduce_float);
|
||||
+ }
|
||||
else
|
||||
+ {
|
||||
bits_image_fetch_pixel_separable_convolution (image, x, y,
|
||||
get_pixel, out,
|
||||
accum_32, reduce_32);
|
||||
+ }
|
||||
break;
|
||||
|
||||
default:
|
||||
+ assert (0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
diff --git a/pixman/pixman-inlines.h b/pixman/pixman-inlines.h
|
||||
index 332e208..f785910 100644
|
||||
--- a/pixman/pixman-inlines.h
|
||||
+++ b/pixman/pixman-inlines.h
|
||||
@@ -231,7 +231,7 @@ bilinear_interpolation_float (argb_t tl, argb_t tr,
|
||||
argb_t r;
|
||||
|
||||
distxy = distx * disty;
|
||||
- distxiy = distx - (1.f - distxy);
|
||||
+ distxiy = distx * (1.f - disty);
|
||||
distixy = (1.f - distx) * disty;
|
||||
distixiy = (1.f - distx) * (1.f - disty);
|
||||
|
||||
--
|
||||
2.37.1
|
||||
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
|
||||
Name: pixman
|
||||
Version: 0.38.4
|
||||
Release: 2%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Summary: Pixel manipulation library
|
||||
|
||||
Group: System Environment/Libraries
|
||||
|
|
@ -17,6 +17,8 @@ Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{ve
|
|||
Source1: make-pixman-snapshot.sh
|
||||
|
||||
Patch0: 0001-Initialize-temporary-buffers-in-general_composite_re.patch
|
||||
Patch1: 0001-Fix-bilinear-filter-computation-in-wide-pipeline.patch
|
||||
Patch2: 0001-Avoid-integer-overflow-leading-to-out-of-bounds-writ.patch
|
||||
|
||||
BuildRequires: automake autoconf libtool
|
||||
BuildRequires: gcc
|
||||
|
|
@ -68,6 +70,12 @@ make check %{?_smp_mflags} V=1
|
|||
%{_libdir}/pkgconfig/pixman-1.pc
|
||||
|
||||
%changelog
|
||||
* Wed Oct 04 2023 José Expósito <jexposit@redhat.com> - 0.38.4-4
|
||||
- Backport fix for CVE-2022-44638
|
||||
|
||||
* Sat Sep 03 2022 Benjamin Gilbert <bgilbert@backtick.net> - 0.38.4-3
|
||||
- Fix bilinear filter computation in wide pipeline
|
||||
|
||||
* Tue Feb 22 2022 Adam Jackson <ajax@redhat.com> - 0.38.4-2
|
||||
- Backport the pixman part of cairo CVE-2020-35492
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue