libjpeg-turbo/libjpeg-turbo-2.0.0-CVE-2017-15232.patch

40 lines
1.7 KiB
Diff

diff -rupN libjpeg-turbo-2.0.0.old/jdpostct.c libjpeg-turbo-2.0.0/jdpostct.c
--- libjpeg-turbo-2.0.0.old/jdpostct.c 2018-07-27 18:47:48.000000000 +0200
+++ libjpeg-turbo-2.0.0/jdpostct.c 2018-08-01 16:10:01.647692751 +0200
@@ -137,6 +137,11 @@ post_process_1pass(j_decompress_ptr cinf
my_post_ptr post = (my_post_ptr)cinfo->post;
JDIMENSION num_rows, max_rows;
+ /* read_and_discard_scanlines may call it with rows "available", but no buffer */
+ if (output_buf == NULL) {
+ return;
+ }
+
/* Fill the buffer, but not more than what we can dump out in one go. */
/* Note we rely on the upsampler to detect bottom of image. */
max_rows = out_rows_avail - *out_row_ctr;
diff -rupN libjpeg-turbo-2.0.0.old/jerror.h libjpeg-turbo-2.0.0/jerror.h
--- libjpeg-turbo-2.0.0.old/jerror.h 2018-07-27 18:47:48.000000000 +0200
+++ libjpeg-turbo-2.0.0/jerror.h 2018-08-01 16:11:31.554054434 +0200
@@ -207,6 +207,7 @@ JMESSAGE(JWRN_ARITH_BAD_CODE, "Corrupt J
#endif
#endif
JMESSAGE(JWRN_BOGUS_ICC, "Corrupt JPEG data: bad ICC marker")
+JMESSAGE(JERR_BAD_PARAM, "Bogus parameter")
#ifdef JMAKE_ENUM_LIST
diff -rupN libjpeg-turbo-2.0.0.old/jquant1.c libjpeg-turbo-2.0.0/jquant1.c
--- libjpeg-turbo-2.0.0.old/jquant1.c 2018-07-27 18:47:48.000000000 +0200
+++ libjpeg-turbo-2.0.0/jquant1.c 2018-08-01 16:12:44.437913930 +0200
@@ -532,6 +532,10 @@ quantize_ord_dither(j_decompress_ptr cin
JDIMENSION col;
JDIMENSION width = cinfo->output_width;
+ if (output_buf == NULL && num_rows) {
+ ERREXIT(cinfo, JERR_BAD_PARAM);
+ }
+
for (row = 0; row < num_rows; row++) {
/* Initialize output values to 0 so can process components separately */
jzero_far((void *)output_buf[row], (size_t)(width * sizeof(JSAMPLE)));