[gentoo-commits] gentoo-x86 commit in media-libs/jpeg/files: jpeg-8d-CVE-2013-6629.patch

[Samuli Suominen (ssuominen)]

ssuominen    14/01/24 12:00:22

  Added:                jpeg-8d-CVE-2013-6629.patch
  Log:
  Fix security bug 491152 (CVE-2013-6629) for jpeg-8d. The patch still applies to jpeg-9 but causes a build failure and needs to be ported.
  
  (Portage version: 2.2.7/cvs/Linux x86_64, signed Manifest commit with key 4868F14D)

Revision  Changes    Path
1.1                  media-libs/jpeg/files/jpeg-8d-CVE-2013-6629.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-libs/jpeg/files/jpeg-8d-CVE-2013-6629.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-libs/jpeg/files/jpeg-8d-CVE-2013-6629.patch?rev=1.1&content-type=text/plain

Index: jpeg-8d-CVE-2013-6629.patch
===================================================================
http://bugs.gentoo.org/491152

--- jdmarker.c
+++ jdmarker.c
@@ -347,6 +347,12 @@
     
     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
+
+    /* This CSi (cc) should differ from the previous CSi */
+    for (ci = 0; ci < i; ci++) {
+      if (cinfo->cur_comp_info[ci] == compptr)
+        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
+    }
   }
 
   /* Collect the additional scan parameters Ss, Se, Ah/Al. */