Add patches for CVE-2009-1720 (multiple integer overflows in OpenEXR) and
CVE-2009-1721 (denial of service (application crash) or possibly execute
arbitrary code in the Imf::hufUncompress function). Bump PKGREVISION.


(hasso)

$NetBSD: patch-ae,v 1.1 2009/08/28 21:33:08 hasso Exp $

--- IlmImf/ImfPreviewImage.cpp.orig	2006-06-06 00:58:16.000000000 -0500
+++ IlmImf/ImfPreviewImage.cpp	2009-07-29 13:27:39.087038617 -0500
@@ -41,6 +41,7 @@
 
 #include <ImfPreviewImage.h>
 #include "Iex.h"
+#include <limits.h>
 
 namespace Imf {
 
@@ -51,6 +52,9 @@ PreviewImage::PreviewImage (unsigned int
 {
     _width = width;
     _height = height;
+    if (_height && _width > UINT_MAX / _height || _width * _height > UINT_MAX / sizeof(PreviewRgba)) {
+        throw Iex::ArgExc ("Invalid height and width.");
+    }
     _pixels = new PreviewRgba [_width * _height];
 
     if (pixels)
diff -up openexr-1.6.1/IlmImf/ImfPreviewImage.h.CVE-2009-1720-1 openexr-1.6.1/IlmImf/ImfPreviewImage.h

$NetBSD: patch-af,v 1.1 2009/08/28 21:33:08 hasso Exp $

--- IlmImf/ImfPizCompressor.cpp.orig	2007-09-20 23:17:46.000000000 -0500
+++ IlmImf/ImfPizCompressor.cpp	2009-07-29 13:15:41.883288491 -0500
@@ -181,6 +181,9 @@ PizCompressor::PizCompressor
     _channels (hdr.channels()),
     _channelData (0)
 {
+    if ((unsigned) maxScanLineSize > (INT_MAX - 65536 - 8192)  / (unsigned) numScanLines) {
+        throw InputExc ("Error: maxScanLineSize * numScanLines would overflow.");
+    }
     _tmpBuffer = new unsigned short [maxScanLineSize * numScanLines / 2];
     _outBuffer = new char [maxScanLineSize * numScanLines + 65536 + 8192];
 

$NetBSD: patch-ag,v 1.1 2009/08/28 21:33:08 hasso Exp $

--- IlmImf/ImfRleCompressor.cpp.orig	2006-10-13 22:06:39.000000000 -0500
+++ IlmImf/ImfRleCompressor.cpp	2009-07-29 13:17:39.505037955 -0500
@@ -164,6 +164,9 @@ RleCompressor::RleCompressor (const Head
     _tmpBuffer (0),
     _outBuffer (0)
 {
+    if ((unsigned) maxScanLineSize > INT_MAX / 3) {
+        throw Iex::InputExc ("Error: maxScanLineSize * 3 would overflow.");
+    }
     _tmpBuffer = new char [maxScanLineSize];
     _outBuffer = new char [maxScanLineSize * 3 / 2];
 }

$NetBSD: patch-ah,v 1.1 2009/08/28 21:33:08 hasso Exp $

--- IlmImf/ImfZipCompressor.cpp.orig	2006-10-13 22:07:17.000000000 -0500
+++ IlmImf/ImfZipCompressor.cpp	2009-07-29 13:18:25.223038291 -0500
@@ -58,6 +58,9 @@ ZipCompressor::ZipCompressor
     _tmpBuffer (0),
     _outBuffer (0)
 {
+    if ((unsigned) maxScanLineSize > INT_MAX / (unsigned) numScanLines) {
+        throw Iex::InputExc ("Error: maxScanLineSize * numScanLines would overflow.");
+    }
     _tmpBuffer =
 	new char [maxScanLineSize * numScanLines];
 

$NetBSD: patch-ai,v 1.1 2009/08/28 21:33:08 hasso Exp $

--- IlmImf/ImfAutoArray.h.orig	2007-04-23 20:26:56.000000000 -0500
+++ IlmImf/ImfAutoArray.h	2009-07-29 13:22:08.309288375 -0500
@@ -57,7 +57,7 @@ namespace Imf {
     {
       public:
 
-	 AutoArray (): _data (new T [size]) {}
+	 AutoArray (): _data (new T [size]) {memset(_data, 0, size * sizeof(T));}
 	~AutoArray () {delete [] _data;}
 
 	operator T * ()			{return _data;}