From 0d37a1ef234c38b27faba43bc3a22f985d311deb Mon Sep 17 00:00:00 2001 From: davidovski Date: Wed, 17 May 2023 17:01:27 +0100 Subject: Remove all firmware --- .../djvulibre-3.5.27-unsigned-short-overflow.patch | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 repo/djvulibre/djvulibre-3.5.27-unsigned-short-overflow.patch (limited to 'repo/djvulibre/djvulibre-3.5.27-unsigned-short-overflow.patch') diff --git a/repo/djvulibre/djvulibre-3.5.27-unsigned-short-overflow.patch b/repo/djvulibre/djvulibre-3.5.27-unsigned-short-overflow.patch new file mode 100644 index 0000000..c7a6f3a --- /dev/null +++ b/repo/djvulibre/djvulibre-3.5.27-unsigned-short-overflow.patch @@ -0,0 +1,21 @@ +diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp +index c2fdbe4..e271a1d 100644 +--- a/libdjvu/GBitmap.cpp ++++ b/libdjvu/GBitmap.cpp +@@ -69,6 +69,7 @@ + #include + #include + #include ++#include + + // - Author: Leon Bottou, 05/1997 + +@@ -1284,6 +1285,8 @@ GBitmap::decode(unsigned char *runs) + // initialize pixel array + if (nrows==0 || ncolumns==0) + G_THROW( ERR_MSG("GBitmap.not_init") ); ++ if (ncolumns > USHRT_MAX - border) ++ G_THROW("GBitmap: row size exceeds maximum (corrupted file?)"); + bytes_per_row = ncolumns + border; + if (runs==0) + G_THROW( ERR_MSG("GBitmap.null_arg") ); -- cgit v1.2.1