Fri Jul 8 11:31:24 2011 UTC ()

add patch from upstream to fix excessive memory use due improper checking
of certain return values in GIF image loader (CVE-2011-2485)
bump PKGREV


(drochner)

diff -r1.5 -r1.6 pkgsrc/graphics/gdk-pixbuf2/Makefile
diff -r1.6 -r1.7 pkgsrc/graphics/gdk-pixbuf2/distinfo
diff -r0 -r1.1 pkgsrc/graphics/gdk-pixbuf2/patches/patch-ag

--- pkgsrc/graphics/gdk-pixbuf2/Makefile 2011/04/22 13:42:26 1.5
+++ pkgsrc/graphics/gdk-pixbuf2/Makefile 2011/07/08 11:31:24 1.6

 @@ -1,19 +1,19 @@
-# $NetBSD: Makefile,v 1.5 2011/04/22 13:42:26 obache Exp $
+# $NetBSD: Makefile,v 1.6 2011/07/08 11:31:24 drochner Exp $
+#
 DISTNAME=	gdk-pixbuf-2.22.1
 PKGNAME=	gdk-pixbuf2-2.22.1
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	graphics
 MASTER_SITES=	${MASTER_SITE_GNOME:=sources/gdk-pixbuf/2.22/}
 EXTRACT_SUFX=	.tar.bz2
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	ftp://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.22/
 COMMENT=	Image loaders for gtk2
 LICENSE=	gnu-gpl-v2
 CONFLICTS+=	gtk2+<2.22
 PKG_DESTDIR_SUPPORT=	user-destdir
 GNU_CONFIGURE=		yes

--- pkgsrc/graphics/gdk-pixbuf2/distinfo 2011/01/24 12:29:42 1.6
+++ pkgsrc/graphics/gdk-pixbuf2/distinfo 2011/07/08 11:31:24 1.7

 @@ -1,11 +1,12 @@
-$NetBSD: distinfo,v 1.6 2011/01/24 12:29:42 wiz Exp $
+$NetBSD: distinfo,v 1.7 2011/07/08 11:31:24 drochner Exp $
 SHA1 (gdk-pixbuf-2.22.1.tar.bz2) = b452208963ddd84f7280865695b50255fcafaa2e
 RMD160 (gdk-pixbuf-2.22.1.tar.bz2) = d05d6642e147281b7dc1dd21657595333f13f6f1
 Size (gdk-pixbuf-2.22.1.tar.bz2) = 1543273 bytes
 SHA1 (patch-aa) = 4ba8d71c089ba1e18ffa42fdb2c9b81b07168411
 SHA1 (patch-ab) = d18a235ce973ef132e9dc777b1cf029b064c02ef
 SHA1 (patch-ac) = f8c8ff3175cee6a88938a0aaa081d3bd832a050d
 SHA1 (patch-ad) = 224ce909009d1d0ac42ba938987877c39b9aa380
 SHA1 (patch-ae) = e13fe0ad5a3e313bc4d6daa3c30f00fb66788534
 SHA1 (patch-af) = 4f7de87f3e840ceb282885ab806648e8dba28cff
 SHA1 (patch-ag) = ac7a5823167eb476c88eb0fe3fde88ccd1b70cf0

$NetBSD: patch-ag,v 1.1 2011/07/08 11:31:24 drochner Exp $

CVE-2011-2485

--- gdk-pixbuf/io-gif.c.orig	2010-07-10 00:54:13.000000000 +0000
+++ gdk-pixbuf/io-gif.c
@@ -1455,6 +1455,7 @@ gdk_pixbuf__gif_image_load (FILE *file, 
 {
 	GifContext *context;
 	GdkPixbuf *pixbuf;
+        gint retval;
 
 	g_return_val_if_fail (file != NULL, NULL);
 
@@ -1472,19 +1473,25 @@ gdk_pixbuf__gif_image_load (FILE *file, 
         context->error = error;
         context->stop_after_first_frame = TRUE;
 
-	if (gif_main_loop (context) == -1 || context->animation->frames == NULL) {
+        retval = gif_main_loop (context);
+	if (retval == -1 || context->animation->frames == NULL) {
                 if (context->error && *(context->error) == NULL)
                         g_set_error_literal (context->error,
                                              GDK_PIXBUF_ERROR,
                                              GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
                                              _("GIF file was missing some data (perhaps it was truncated somehow?)"));
         }
+        else if (retval == -2) {
+                pixbuf = NULL;
+                goto out;
+        }
         
         pixbuf = gdk_pixbuf_animation_get_static_image (GDK_PIXBUF_ANIMATION (context->animation));
 
         if (pixbuf)
                 g_object_ref (pixbuf);
 
+out:
         g_object_unref (context->animation);
         
         g_free (context->buf);