pixman: Changes to 'debian-unstable'
debian/changelog | 7 +++++++
pixman/pixman-inlines.h | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
New commits:
commit 259f6811872a1ab60089ec094c0d8129e03dae85
Author: Julien Cristau <jcristau@debian.org>
Date: Mon Feb 18 20:17:18 2013 +0100
Upload to unstable
diff --git a/debian/changelog b/debian/changelog
index f23215c..93c3e94 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+pixman (0.26.0-4) sid; urgency=high
+
+ * Fix for CVE-2013-1591 (stack-based buffer overflow), cherry-picked from
+ 0.27.4 (closes: #700308).
+
+ -- Julien Cristau <jcristau@debian.org> Mon, 18 Feb 2013 19:58:33 +0100
+
pixman (0.26.0-3) unstable; urgency=low
* Pass LS_CFLAGS=" " to configure to prevent -march=loongson2f from
commit 6dfdd8534f92efc48efb35266b1c42eaaf073f8b
Author: Søren Sandmann Pedersen <ssp@redhat.com>
Date: Sat Sep 15 03:13:09 2012 -0400
Fix for infinite-loop test
The infinite loop detected by "affine-test 212944861" is caused by an
overflow in this expression:
max_x = pixman_fixed_to_int (vx + (width - 1) * unit_x) + 1;
where (width - 1) * unit_x doesn't fit in a signed int. This causes
max_x to be too small so that this:
src_width = 0
while (src_width < REPEAT_NORMAL_MIN_WIDTH && src_width <= max_x)
src_width += src_image->bits.width;
results in src_width being 0. Later on when src_width is used for
repeat calculations, we get the infinite loop.
By casting unit_x to int64_t, the expression no longer overflows and
affine-test 212944861 and infinite-loop no longer loop forever.
(cherry picked from commit de60e2e0e3eb6084f8f14b63f25b3cbfb012943f)
diff --git a/pixman/pixman-inlines.h b/pixman/pixman-inlines.h
index 3532867..66c998e 100644
--- a/pixman/pixman-inlines.h
+++ b/pixman/pixman-inlines.h
@@ -844,7 +844,7 @@ fast_composite_scaled_bilinear ## scale_func_name (pixman_implementation_t *imp,
{ \
vx = v.vector[0]; \
repeat (PIXMAN_REPEAT_NORMAL, &vx, pixman_int_to_fixed(src_image->bits.width)); \
- max_x = pixman_fixed_to_int (vx + (width - 1) * unit_x) + 1; \
+ max_x = pixman_fixed_to_int (vx + (width - 1) * (int64_t)unit_x) + 1; \
\
if (src_image->bits.width < REPEAT_NORMAL_MIN_WIDTH) \
{ \
Reply to: