rpms/gd/F-7 gd-2.0.35-AALineThick.patch, NONE, 1.1 gd-2.0.35-overflow.patch, NONE, 1.1 .cvsignore, 1.12, 1.13 gd.spec, 1.42, 1.43 sources, 1.11, 1.12 gd-2.0.33-AALineThick.patch, 1.1, NONE gd-2.0.33-overflow.patch, 1.1, NONE

[Ivana Varekova (varekova)]

Author: varekova

Update of /cvs/pkgs/rpms/gd/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv23717

Modified Files:
	.cvsignore gd.spec sources 
Added Files:
	gd-2.0.35-AALineThick.patch gd-2.0.35-overflow.patch 
Removed Files:
	gd-2.0.33-AALineThick.patch gd-2.0.33-overflow.patch 
Log Message:
update to 2.0.35
fix several vulnerabilities #277421


gd-2.0.35-AALineThick.patch:

--- NEW FILE gd-2.0.35-AALineThick.patch ---
--- gd-2.0.35/gd.c.pom	2007-06-19 22:25:51.000000000 +0200
+++ gd-2.0.35/gd.c	2007-09-05 11:25:16.000000000 +0200
@@ -3474,6 +3474,8 @@ static void gdImageAALine (gdImagePtr im
 	/* keep them as 32bits */
 	long x, y, inc;
 	long dx, dy,tmp;
+	int w, wid, wstart; 
+	int thick = im->thick; 
 
 	if (!im->trueColor) {
 		/* TBB: don't crash when the image is of the wrong type */
@@ -3502,6 +3504,25 @@ static void gdImageAALine (gdImagePtr im
 		gdImageSetAAPixelColor(im, x1, y1, col, 0xFF);
 		return;
 	}
+	else { 
+	    double ag; 
+	    if (dy < dx)  
+		ag  = cos (atan2 (dy, dx)); 
+	    else  
+		ag = sin (atan2 (dy, dx)); 
+	    if (ag != 0)
+	    {
+		wid = thick / ag; 
+	    }
+	    else
+	    {
+		wid = 1;
+	    } 
+	    if (wid == 0)
+	    {
+		wid = 1;
+	    } 
+	} 
 	if (abs(dx) > abs(dy)) {
 		if (dx < 0) {
 			tmp = x1;
@@ -3518,8 +3539,11 @@ static void gdImageAALine (gdImagePtr im
 		inc = (dy * 65536) / dx;
 		/* TBB: set the last pixel for consistency (<=) */
 		while ((x >> 16) <= x2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
-			gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+			wstart = (y >> 16) - wid / 2;
+			for (w = wstart; w < wstart + wid; w++) {    
+			    gdImageSetAAPixelColor(im, (x >> 16) , w , col , (y >> 8) & 0xFF); 
+			    gdImageSetAAPixelColor(im, (x >> 16) , w + 1 , col, (~y >> 8) & 0xFF); 
+			} 
 			x += (1 << 16);
 			y += inc;
 		}
@@ -3539,8 +3563,11 @@ static void gdImageAALine (gdImagePtr im
 		inc = (dx * 65536) / dy;
 		/* TBB: set the last pixel for consistency (<=) */
 		while ((y>>16) <= y2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
-			gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+			wstart = (x >> 16) - wid / 2;
+			for (w = wstart; w < wstart + wid; w++) { 
+			    gdImageSetAAPixelColor(im, w , y >> 16  , col, (x >> 8) & 0xFF);                    
+			    gdImageSetAAPixelColor(im, w + 1, y >> 16, col, (~x >> 8) & 0xFF);   
+			}
 			x += inc;
 			y += (1<<16);
 		}

gd-2.0.35-overflow.patch:

--- NEW FILE gd-2.0.35-overflow.patch ---
--- gd-2.0.35/gd_gd.c.pom	2006-04-05 17:52:22.000000000 +0200
+++ gd-2.0.35/gd_gd.c	2007-09-05 11:31:39.000000000 +0200
@@ -149,6 +149,10 @@ _gdCreateFromFile (gdIOCtx * in, int *sx
     {
       im = gdImageCreate (*sx, *sy);
     }
+  if (!im) 
+    { 
+      goto fail1; 
+    } 
   if (!_gdGetColors (in, im, gd2xFlag))
     {
       goto fail2;


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/gd/F-7/.cvsignore,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- .cvsignore	8 Feb 2007 13:09:04 -0000	1.12
+++ .cvsignore	5 Sep 2007 09:43:55 -0000	1.13
@@ -1 +1 @@
-gd-2.0.34.tar.bz2
+gd-2.0.35.tar.bz2


Index: gd.spec
===================================================================
RCS file: /cvs/pkgs/rpms/gd/F-7/gd.spec,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -r1.42 -r1.43
--- gd.spec	22 Feb 2007 12:44:56 -0000	1.42
+++ gd.spec	5 Sep 2007 09:43:55 -0000	1.43
@@ -1,7 +1,7 @@
 Summary:       A graphics library for quick creation of PNG or JPEG images
 Name:          gd
-Version:       2.0.34
-Release:       2%{?dist}
+Version:       2.0.35
+Release:       1%{?dist}
 Group:         System Environment/Libraries
 License:       BSD-style
 URL:           http://www.libgd.org/Main_Page
@@ -10,8 +10,8 @@
 Patch3:        gd-2.0.34-multilib.patch
 Patch4:        gd-loop.patch
 Patch5:        gd-2.0.34-sparc64.patch
-Patch6:        gd-2.0.33-overflow.patch
-Patch7:        gd-2.0.33-AALineThick.patch
+Patch6:        gd-2.0.35-overflow.patch
+Patch7:        gd-2.0.35-AALineThick.patch
 Patch8:        gd-2.0.33-BoxBound.patch
 BuildRoot:     %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: freetype-devel, fontconfig-devel, libX11-devel, libXpm-devel
@@ -98,6 +98,10 @@
 
 
 %changelog
+* Wed Sep  5 2007 Ivana varekova <varekova at redhat.com> 2.0.35-1
+- update to 2.0.35
+- fix several vulnerabilities #277421
+
 * Thu Feb 22 2007 Ivana Varekova <varekova at redhat.com> 2.0.34-2
 - incorporate package review feedback
 


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/gd/F-7/sources,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- sources	8 Feb 2007 13:09:04 -0000	1.11
+++ sources	5 Sep 2007 09:43:55 -0000	1.12
@@ -1 +1 @@
-8c25c322f12030b1c24488efd577fec0  gd-2.0.34.tar.bz2
+6c6c3dbb7bf079e0bb5fbbfd3bb8a71c  gd-2.0.35.tar.bz2


--- gd-2.0.33-AALineThick.patch DELETED ---


--- gd-2.0.33-overflow.patch DELETED ---