Pullup ticket 3027 - requested by taca
security patch

Revisions pulled up:
- pkgsrc/x11/wxGTK24/Makefile		1.11
- pkgsrc/x11/wxGTK24/distinfo		1.10

Files added:
pkgsrc/x11/wxGTK24/patches/patch-am
pkgsrc/x11/wxGTK24/patches/patch-an
pkgsrc/x11/wxGTK24/patches/patch-ao
pkgsrc/x11/wxGTK24/patches/patch-ap

   --------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   taca
   Date:           Tue Feb 16 17:33:39 UTC 2010

   Modified Files:
           pkgsrc/x11/wxGTK24: Makefile distinfo
   Added Files:
           pkgsrc/x11/wxGTK24/patches: patch-am patch-an patch-ao patch-ap

   Log Message:
   Add patches for CVE-2009-2625 and CVE-2009-2369.

   Bump PKGREVISION.

   To generate a diff of this commit:
   cvs rdiff -u -r1.10 -r1.11 pkgsrc/x11/wxGTK24/Makefile
   cvs rdiff -u -r1.9 -r1.10 pkgsrc/x11/wxGTK24/distinfo
   cvs rdiff -u -r0 -r1.1 pkgsrc/x11/wxGTK24/patches/patch-am \
       pkgsrc/x11/wxGTK24/patches/patch-an pkgsrc/x11/wxGTK24/patches/patch-ao \
       pkgsrc/x11/wxGTK24/patches/patch-ap


(spz)

$NetBSD: patch-am,v 1.1.2.2 2010/02/28 13:15:02 spz Exp $

deal with CVE-2009-2625.

--- contrib/src/xrc/expat/xmltok/xmltok_impl.c.orig	2003-09-21 11:32:55.000000000 +0000
+++ contrib/src/xrc/expat/xmltok/xmltok_impl.c
@@ -1753,7 +1753,7 @@ void PREFIX(updatePosition)(const ENCODI
 			    const char *end,
 			    POSITION *pos)
 {
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: \

$NetBSD: patch-an,v 1.1.2.2 2010/02/28 13:15:02 spz Exp $

deal with CVE-2009-2369.

--- src/common/image.cpp.orig	2003-09-21 11:31:39.000000000 +0000
+++ src/common/image.cpp
@@ -147,6 +147,10 @@ void wxImage::Create( int width, int hei
 
     m_refData = new wxImageRefData();
 
+    if (width <= 0 || height <= 0 || width > INT_MAX / 3 / height) {
+	UnRef();
+	return;
+    }
     M_IMGDATA->m_data = (unsigned char *) malloc( width*height*3 );
     if (M_IMGDATA->m_data)
     {

$NetBSD: patch-ao,v 1.1.2.2 2010/02/28 13:15:02 spz Exp $

deal with CVE-2009-2369.

--- src/common/imagpng.cpp.orig	2003-09-21 11:31:39.000000000 +0000
+++ src/common/imagpng.cpp
@@ -213,18 +213,16 @@ bool wxPNGHandler::LoadFile( wxImage *im
     if (!image->Ok())
         goto error_nolines;
 
-    lines = (unsigned char **)malloc( (size_t)(height * sizeof(unsigned char *)) );
+    // initialize all line pointers to NULL to ensure that they can be safely
+    // free()d if an error occurs before all of them could be allocated
+    lines = (unsigned char **)calloc(height, sizeof(unsigned char *));
     if (lines == NULL)
         goto error_nolines;
 
     for (i = 0; i < height; i++)
     {
         if ((lines[i] = (unsigned char *)malloc( (size_t)(width * (sizeof(unsigned char) * 4)))) == NULL)
-        {
-            for ( unsigned int n = 0; n < i; n++ )
-                free( lines[n] );
             goto error;
-        }
     }
 
     // loaded successfully!

$NetBSD: patch-ap,v 1.1.2.2 2010/02/28 13:15:02 spz Exp $

deal with CVE-2009-2369.

--- src/common/imagtiff.cpp.orig	2003-09-21 11:31:39.000000000 +0000
+++ src/common/imagtiff.cpp
@@ -188,15 +188,25 @@ bool wxTIFFHandler::LoadFile( wxImage *i
     }
 
     uint32 w, h;
-    uint32 npixels;
     uint32 *raster;
 
     TIFFGetField( tif, TIFFTAG_IMAGEWIDTH, &w );
     TIFFGetField( tif, TIFFTAG_IMAGELENGTH, &h );
 
-    npixels = w * h;
+    // guard against integer overflow during multiplication which could result
+    // in allocating a too small buffer and then overflowing it
+    const double bytesNeeded = (double)w * (double)h * sizeof(uint32);
+    if ( bytesNeeded >= 4294967295U /* UINT32_MAX */ )
+    {
+	if ( verbose )
+	    wxLogError( _("TIFF: Image size is abnormally big.") );
+
+	TIFFClose(tif);
+
+	return false;
+    }
 
-    raster = (uint32*) _TIFFmalloc( npixels * sizeof(uint32) );
+    raster = (uint32*) _TIFFmalloc( bytesNeeded );
 
     if (!raster)
     {