[gentoo-commits] gentoo-x86 commit in media-gfx/gif2png/files: gif2png-2.5.1-overflow.patch

[Markus Meier (maekke)]

maekke      10/12/03 09:41:07

  Added:                gif2png-2.5.1-overflow.patch
  Log:
  fix overflow bug #346501
  
  (Portage version: 2.1.9.25/cvs/Linux i686)

Revision  Changes    Path
1.1                  media-gfx/gif2png/files/gif2png-2.5.1-overflow.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gif2png/files/gif2png-2.5.1-overflow.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gif2png/files/gif2png-2.5.1-overflow.patch?rev=1.1&content-type=text/plain

Index: gif2png-2.5.1-overflow.patch
===================================================================
Fixes cmdline buffer overflow described in

http://lists.grok.org.uk/pipermail/full-disclosure/2009-December/072002.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978

Index: gif2png-2.5.3/gif2png.c
===================================================================
--- gif2png-2.5.3.orig/gif2png.c
+++ gif2png-2.5.3/gif2png.c
@@ -675,7 +675,10 @@ int processfile(char *fname, FILE *fp)
 
     strcpy(outname, fname);
 
-    file_ext = outname+strlen(outname)-4;
+    file_ext = outname+strlen(outname);
+    if (file_ext >= outname + 4)
+	file_ext -= 4;
+
     if (strcmp(file_ext, ".gif") != 0 && strcmp(file_ext, ".GIF") != 0 &&
 	strcmp(file_ext, "_gif") != 0 && strcmp(file_ext, "_GIF") != 0) {
 	/* try to derive basename */
@@ -863,6 +866,14 @@ int main(int argc, char *argv[])
 	}
     } else {
 	for (i = ac;i<argc; i++) {
+	    /* make sure that there is enough space for a '.p<NUM>' suffix;
+	       this check catches also the '.gif' case below. */
+	    if (strlen(argv[i]) >= sizeof name - sizeof ".p" - 3 * sizeof(int)) {
+		fprintf(stderr, "%s: name too long\n", argv[i]);
+		errors = 1;
+		continue;
+	    }
+
 	    strcpy(name, argv[i]);
 	    if ((fp = fopen(name, "rb")) == NULL) {
 		/* retry with .gif appended */