Attachment 140313 Details for Bug 107023 – Patch to fix the issue

[patch] Patch to fix the issue

xcursorgen-null.patch (text/plain), 1.10 KB, created by Tobias Stoeckmann on 2018-06-25 07:09:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tobias Stoeckmann

Created: 2018-06-25 07:09:39 UTC

Size: 1.10 KB

patch

obsolete

>From 043f8275b82747fef69f03af48415c0fd44cbde2 Mon Sep 17 00:00:00 2001
>From: Tobias Stoeckmann <tobias@stoeckmann.org>
>Date: Mon, 25 Jun 2018 09:02:24 +0200
>Subject: [PATCH] Fix null pointer dereference on very large images.
>
>If xcursorgen encounters a PNG file which is larger than 32767 pixels
>in width or height, a null pointer dereference occurs because the
>return value of XcursorImageCreate is not checked.
>
>The largest possible value is 32767 for libXcursor, which is a hard
>coded limit due to a 16 bit integer used (0x7FFF).
>
>Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
>---
> xcursorgen.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/xcursorgen.c b/xcursorgen.c
>index f292f19..d664799 100644
>--- a/xcursorgen.c
>+++ b/xcursorgen.c
>@@ -262,6 +262,12 @@ load_image (struct flist *list, const char *prefix)
>   png_read_update_info (png, info);
> 
>   image = XcursorImageCreate (width, height);
>+  if (image == NULL)
>+    {
>+      fclose (fp);
>+      png_destroy_read_struct (&png, &info, NULL);
>+      return NULL;
>+    }
> 
>   image->size = list->size;
>   image->xhot = list->xhot;
>-- 
>2.18.0
>

Actions: View | Splinter Review

Attachments on bug 107023: 140313

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.