diff options
Diffstat (limited to 'app-text/mupdf/files/mupdf-1.18.0-fix-oob-in-pixmap.c')
-rw-r--r-- | app-text/mupdf/files/mupdf-1.18.0-fix-oob-in-pixmap.c | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/app-text/mupdf/files/mupdf-1.18.0-fix-oob-in-pixmap.c b/app-text/mupdf/files/mupdf-1.18.0-fix-oob-in-pixmap.c new file mode 100644 index 000000000000..d19f0593a119 --- /dev/null +++ b/app-text/mupdf/files/mupdf-1.18.0-fix-oob-in-pixmap.c @@ -0,0 +1,41 @@ +From 32e4e8b4bcbacbf92af7c88337efae21986d9603 Mon Sep 17 00:00:00 2001 +From: Robin Watts <Robin.Watts@artifex.com> +Date: Thu, 8 Oct 2020 18:10:28 +0100 +Subject: [PATCH] Bug 702958: Fix overflow in fz_clear_pixmap_with_value. + +--- + source/fitz/pixmap.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c +index 66873d214..80d8bb62f 100644 +--- a/source/fitz/pixmap.c ++++ b/source/fitz/pixmap.c +@@ -555,7 +555,8 @@ void + fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + { + unsigned char *s; +- int w, h, n, stride, len; ++ int w, h, n; ++ ptrdiff_t stride, len; + int alpha = pix->alpha; + + w = pix->w; +@@ -572,7 +573,7 @@ fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + + n = pix->n; + stride = pix->stride; +- len = w * n; ++ len = (ptrdiff_t)w * n; + + s = pix->samples; + if (value == 255 || !alpha) +@@ -584,7 +585,7 @@ fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + } + while (h--) + { +- memset(s, value, (unsigned int)len); ++ memset(s, value, len); + s += stride; + } + } |