Added fix for mozbz#727401

mozilla-727401.patch

@@ -0,0 +1,38 @@
+# HG changeset patch
+# User Benjamin Smedberg <benjamin@smedbergs.us>
+# Date 1329314881 18000
+# Node ID 355163c56ea5ad5037ac6da754252aaea67d2217
+# Parent  81f6b9cbb2a92ac08d1ccc0c1b44d6a5c28f6e2a
+Bug 727401 - import libpng overflow patch from http://codereview.chromium.org/9363013
+
+diff --git a/media/libpng/pngrutil.c b/media/libpng/pngrutil.c
+--- a/media/libpng/pngrutil.c
++++ b/media/libpng/pngrutil.c
+@@ -396,18 +396,25 @@ png_decompress_chunk(png_structp png_ptr
+ #if defined(PNG_SET_CHUNK_MALLOC_LIMIT_SUPPORTED) || \
+     defined(PNG_USER_CHUNK_MALLOC_MAX)
+       else
+ #endif
+       if (expanded_size > 0)
+       {
+          /* Success (maybe) - really uncompress the chunk. */
+          png_size_t new_size = 0;
+-         png_charp text = png_malloc_warn(png_ptr,
+-                        prefix_size + expanded_size + 1);
++         png_charp text = NULL;
++         /* Need to check for both truncation (64-bit platforms) and integer
++          * overflow.
++          */
++         if (prefix_size + expanded_size > prefix_size &&
++             prefix_size + expanded_size < 0xffffffffU)
++         {
++            text = png_malloc_warn(png_ptr, prefix_size + expanded_size + 1);
++         }
+ 
+          if (text != NULL)
+          {
+             png_memcpy(text, png_ptr->chunkdata, prefix_size);
+             new_size = png_inflate(png_ptr,
+                 (png_bytep)(png_ptr->chunkdata + prefix_size),
+                 chunklength - prefix_size,
+                 (png_bytep)(text + prefix_size), expanded_size);

thunderbird.spec

@@ -33,7 +33,7 @@
 Summary:        Mozilla Thunderbird mail/newsgroup client
 Name:           thunderbird
 Version:        10.0.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 URL:            http://www.mozilla.org/projects/thunderbird/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 Group:          Applications/Internet
@@ -60,6 +60,7 @@ Patch7:         crashreporter-remove-static.patch
 Patch8:         xulrunner-10.0-secondary-ipc.patch
 # # cherry-picked from 13afcd4c097c
 Patch13:        xulrunner-9.0-secondary-build-fix.patch
+Patch14:        mozilla-727401.patch
 
 # Build patches
 Patch100:       xulrunner-10.0-gcc47.patch
@@ -149,6 +150,7 @@ cd mozilla
 %patch7 -p2 -b .static
 %patch8 -p3 -b .secondary-ipc
 %patch13 -p2 -b .secondary-build
+%patch14 -p1 -b .727401
 %if 0%{?fedora} >= 17
 %patch100 -p1 -b .gcc47
 %endif
@@ -370,6 +372,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #===============================================================================
 
 %changelog
+* Thu Feb 16 2012 Martin Stransky <stransky@redhat.com> - 10.0.1-2
+- Added fix for mozbz#727401
+
 * Thu Feb  9 2012 Jan Horak <jhorak@redhat.com> - 10.0.1-1
 - Update to 10.0.1