rpms/thunderbird
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Added fix for mozbz#727401

Browse Source
This commit is contained in:
Martin Stransky 2012-02-16 13:08:23 +01:00
parent 657db173d7
commit 86b0cb0fd8
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
mozilla-727401.patch Normal file
View File

@ -0,0 +1,38 @@
# HG changeset patch
# User Benjamin Smedberg <benjamin@smedbergs.us>
# Date 1329314881 18000
# Node ID 355163c56ea5ad5037ac6da754252aaea67d2217
# Parent 81f6b9cbb2a92ac08d1ccc0c1b44d6a5c28f6e2a
Bug 727401 - import libpng overflow patch from http://codereview.chromium.org/9363013
diff --git a/media/libpng/pngrutil.c b/media/libpng/pngrutil.c
--- a/media/libpng/pngrutil.c
+++ b/media/libpng/pngrutil.c
@@ -396,18 +396,25 @@ png_decompress_chunk(png_structp png_ptr
#if defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED) || \
defined(PNG_USER_CHUNK_MALLOC_MAX)
else
#endif
if (expanded_size > 0)
{
/* Success (maybe) - really uncompress the chunk. */
png_size_t new_size = 0;
- png_charp text = png_malloc_warn(png_ptr,
- prefix_size + expanded_size + 1);
+ png_charp text = NULL;
+ /* Need to check for both truncation (64-bit platforms) and integer
+ * overflow.
+ */
+ if (prefix_size + expanded_size > prefix_size &&
+ prefix_size + expanded_size < 0xffffffffU)
+ {
+ text = png_malloc_warn(png_ptr, prefix_size + expanded_size + 1);
+ }
if (text != NULL)
{
png_memcpy(text, png_ptr->chunkdata, prefix_size);
new_size = png_inflate(png_ptr,
(png_bytep)(png_ptr->chunkdata + prefix_size),
chunklength - prefix_size,
(png_bytep)(text + prefix_size), expanded_size);

7
thunderbird.spec
View File

@ -33,7 +33,7 @@
Summary: Mozilla Thunderbird mail/newsgroup client
Name: thunderbird
Version: 10.0.1
Release: 1%{?dist}
Release: 2%{?dist}
URL: http://www.mozilla.org/projects/thunderbird/
License: MPLv1.1 or GPLv2+ or LGPLv2+
Group: Applications/Internet
@ -60,6 +60,7 @@ Patch7: crashreporter-remove-static.patch
Patch8: xulrunner-10.0-secondary-ipc.patch
# # cherry-picked from 13afcd4c097c
Patch13: xulrunner-9.0-secondary-build-fix.patch
Patch14: mozilla-727401.patch
# Build patches
Patch100: xulrunner-10.0-gcc47.patch
@ -149,6 +150,7 @@ cd mozilla
%patch7 -p2 -b .static
%patch8 -p3 -b .secondary-ipc
%patch13 -p2 -b .secondary-build
%patch14 -p1 -b .727401
%if 0%{?fedora} >= 17
%patch100 -p1 -b .gcc47
%endif
@ -370,6 +372,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
#===============================================================================
%changelog
* Thu Feb 16 2012 Martin Stransky <stransky@redhat.com> - 10.0.1-2
- Added fix for mozbz#727401
* Thu Feb 9 2012 Jan Horak <jhorak@redhat.com> - 10.0.1-1
- Update to 10.0.1