From e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Tue, 22 Sep 2015 22:44:51 +0200
Subject: [PATCH] pixops: Don't overflow variables when shifting them

If we shift by 16 bits we need to be sure those 16 bits actually exist.
They do now.

Upstream-status: Backport
https://git.gnome.org/browse/gdk-pixbuf/commit/?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa

CVE:  CVE-2015-7674
Signed-off-by: Armin Kuster <akuster@mvista.com>

---
 gdk-pixbuf/pixops/pixops.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Index: gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c
===================================================================
--- gdk-pixbuf-2.30.8.orig/gdk-pixbuf/pixops/pixops.c
+++ gdk-pixbuf-2.30.8/gdk-pixbuf/pixops/pixops.c
@@ -264,11 +264,11 @@ pixops_scale_nearest (guchar        *des
 		      double         scale_x,
 		      double         scale_y)
 {
-  int i;
-  int x;
-  int x_step = (1 << SCALE_SHIFT) / scale_x;
-  int y_step = (1 << SCALE_SHIFT) / scale_y;
-  int xmax, xstart, xstop, x_pos, y_pos;
+  gint64 i;
+  gint64 x;
+  gint64 x_step = (1 << SCALE_SHIFT) / scale_x;
+  gint64 y_step = (1 << SCALE_SHIFT) / scale_y;
+  gint64 xmax, xstart, xstop, x_pos, y_pos;
   const guchar *p;
 
 #define INNER_LOOP(SRC_CHANNELS,DEST_CHANNELS,ASSIGN_PIXEL)     \