I've NMUed this package to fix the DOS, with the attached patch. -- see shy jo
diff -ur old/gdk-pixbuf-0.22.0/debian/changelog
gdk-pixbuf-0.22.0/debian/changelog
--- old/gdk-pixbuf-0.22.0/debian/changelog 2005-04-14 14:21:12.000000000
-0400
+++ gdk-pixbuf-0.22.0/debian/changelog 2005-04-14 14:20:35.000000000 -0400
@@ -1,3 +1,11 @@
+gdk-pixbuf (0.22.0-7.1) unstable; urgency=HIGH
+
+ * gdk-pixbuf/io-bmp.c, grow_buffer(): Fix double free() leading
+ to a crash with malicious BMP images. Closes: #303441 (CAN-2005-0891)
+ * Above patch from Martin Pitt.
+
+ -- Joey Hess <[EMAIL PROTECTED]> Thu, 14 Apr 2005 14:20:01 -0400
+
gdk-pixbuf (0.22.0-7) unstable; urgency=high
* Applied patch by Matthias Clasen to fix integer overflow in the ico
diff -ur old/gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c
gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c
--- old/gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2005-04-14 14:21:12.000000000
-0400
+++ gdk-pixbuf-0.22.0/gdk-pixbuf/io-bmp.c 2005-04-14 14:19:05.000000000
-0400
@@ -245,7 +245,15 @@
static gboolean
grow_buffer (struct bmp_progressive_state *State)
{
- guchar *tmp = realloc (State->buff, State->BufferSize);
+ guchar *tmp;
+
+ if (State->BufferSize == 0) {
+ State->read_state = READ_STATE_ERROR;
+ return FALSE;
+ }
+
+ tmp = g_try_realloc (State->buff, State->BufferSize);
+
if (!tmp) {
State->read_state = READ_STATE_ERROR;
return FALSE;
signature.asc
Description: Digital signature
