| From e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa Mon Sep 17 00:00:00 2001 |
| From: Benjamin Otte <otte@redhat.com> |
| Date: Tue, 22 Sep 2015 22:44:51 +0200 |
| Subject: [PATCH] pixops: Don't overflow variables when shifting them |
| |
| If we shift by 16 bits we need to be sure those 16 bits actually exist. |
| They do now. |
| |
| Upstream-status: Backport |
| https://git.gnome.org/browse/gdk-pixbuf/commit/?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa |
| |
| CVE: CVE-2015-7674 |
| Signed-off-by: Armin Kuster <akuster@mvista.com> |
| |
| --- |
| gdk-pixbuf/pixops/pixops.c | 10 +++++----- |
| 1 file changed, 5 insertions(+), 5 deletions(-) |
| |
| Index: gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c |
| =================================================================== |
| --- gdk-pixbuf-2.30.8.orig/gdk-pixbuf/pixops/pixops.c |
| +++ gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c |
| @@ -264,11 +264,11 @@ pixops_scale_nearest (guchar *des |
| double scale_x, |
| double scale_y) |
| { |
| - int i; |
| - int x; |
| - int x_step = (1 << SCALE_SHIFT) / scale_x; |
| - int y_step = (1 << SCALE_SHIFT) / scale_y; |
| - int xmax, xstart, xstop, x_pos, y_pos; |
| + gint64 i; |
| + gint64 x; |
| + gint64 x_step = (1 << SCALE_SHIFT) / scale_x; |
| + gint64 y_step = (1 << SCALE_SHIFT) / scale_y; |
| + gint64 xmax, xstart, xstop, x_pos, y_pos; |
| const guchar *p; |
| |
| #define INNER_LOOP(SRC_CHANNELS,DEST_CHANNELS,ASSIGN_PIXEL) \ |