From 9097b9a1f29939d4996b0a685847517d02f7b5ad Mon Sep 17 00:00:00 2001
From: Patrick J Volkerding <volkerdi@slackware.com>
Date: Fri, 25 May 2018 23:29:36 +0000
Subject: Fri May 25 23:29:36 UTC 2018

patches/packages/glibc-zoneinfo-2018e-noarch-2_slack13.37.txz:  Rebuilt.
  Handle removal of US/Pacific-New timezone. If we see that the machine is
  using this, it will be automatically switched to US/Pacific.
---
 .../gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff      | 64 ++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 patches/source/gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff

(limited to 'patches/source/gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff')

diff --git a/patches/source/gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff b/patches/source/gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff
new file mode 100644
index 000000000..8d1b680e5
--- /dev/null
+++ b/patches/source/gdk-pixbuf2/gdk-pixbuf.CVE-2015-4491.diff
@@ -0,0 +1,64 @@
+@@ -, +, @@ 
+ gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+--- a/gdk-pixbuf/pixops/pixops.c	
++++ a/gdk-pixbuf/pixops/pixops.c	
+@@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter)
+   int i_offset, j_offset;
+   int n_x = filter->x.n;
+   int n_y = filter->y.n;
+-  int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y);
++  gsize n_weights;
++  int *weights;
++
++  n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
++  if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x * n_y)
++    return NULL; /* overflow, bail */
++
++  weights = g_new (int, n_weights);
++  if (!weights)
++    return NULL; /* overflow, bail */
+ 
+   for (i_offset=0; i_offset < SUBSAMPLE; i_offset++)
+     for (j_offset=0; j_offset < SUBSAMPLE; j_offset++)
+@@ -1347,8 +1356,11 @@ pixops_process (guchar         *dest_buf,
+   if (x_step == 0 || y_step == 0)
+     return; /* overflow, bail out */
+ 
+-  line_bufs = g_new (guchar *, filter->y.n);
+   filter_weights = make_filter_table (filter);
++  if (!filter_weights)
++    return; /* overflow, bail out */
++
++  line_bufs = g_new (guchar *, filter->y.n);
+ 
+   check_shift = check_size ? get_check_shift (check_size) : 0;
+ 
+@@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim,
+ 		   double                 scale)
+ {
+   int n = ceil (1 / scale + 1);
+-  double *pixel_weights = g_new (double, SUBSAMPLE * n);
++  double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+   int offset;
+   int i;
+ 
+@@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension *dim,
+     }
+ 
+   dim->n = n;
+-  dim->weights = g_new (double, SUBSAMPLE * n);
++  dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+ 
+   pixel_weights = dim->weights;
+ 
+@@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim,
+ 			   double                 scale)
+ {
+   int n = ceil (1/scale + 3.0);
+-  double *pixel_weights = g_new (double, SUBSAMPLE * n);
++  double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+   double w;
+   int offset, i;
+ 
+
-- 
cgit v1.2.3-65-gdbad