cups/cups-1.4.8-CVE-2011-3170.diff
2012-04-10 14:33:40 +04:00

38 lines
953 B
Diff

http://www.cups.org/str.php?L3914
svn diff -c 9865 http://svn.easysw.com/public/cups/
https://bugzilla.redhat.com/show_bug.cgi?id=727800#c8
--- filter/image-gif.c 2011-06-20 20:37:51.000000000 +0000
+++ filter/image-gif.c.oden 2011-10-10 08:50:17.000000000 +0000
@@ -648,11 +648,13 @@ gif_read_lzw(FILE *fp, /* I - File to
if (code == max_code)
{
- *sp++ = firstcode;
- code = oldcode;
+ if (sp < (stack + 8192))
+ *sp++ = firstcode;
+
+ code = oldcode;
}
- while (code >= clear_code)
+ while (code >= clear_code && sp < (stack + 8192))
{
*sp++ = table[1][code];
if (code == table[0][code])
@@ -661,8 +663,10 @@ gif_read_lzw(FILE *fp, /* I - File to
code = table[0][code];
}
- *sp++ = firstcode = table[1][code];
- code = max_code;
+ if (sp < (stack + 8192))
+ *sp++ = firstcode = table[1][code];
+
+ code = max_code;
if (code < 4096)
{