rpms/imlib2/devel imlib2-1.4.2-cve-2008-5187, NONE, 1.1 imlib2.spec, 1.34, 1.35

[Tomas Smetana]

Author: tsmetana

Update of /cvs/pkgs/rpms/imlib2/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv9874

Modified Files:
	imlib2.spec 
Added Files:
	imlib2-1.4.2-cve-2008-5187 
Log Message:
patch for CVE-2008-5187



--- NEW FILE imlib2-1.4.2-cve-2008-5187 ---
diff -up imlib2-1.4.2/src/modules/loaders/loader_xpm.c.cve-2008-5187 imlib2-1.4.2/src/modules/loaders/loader_xpm.c
--- imlib2-1.4.2/src/modules/loaders/loader_xpm.c.cve-2008-5187	2008-11-23 11:10:05.000000000 +0100
+++ imlib2-1.4.2/src/modules/loaders/loader_xpm.c	2008-11-23 11:10:38.000000000 +0100
@@ -253,8 +253,8 @@ load(ImlibImage * im, ImlibProgressFunct
                                  return 0;
                               }
                             ptr = im->data;
-                            end = ptr + (sizeof(DATA32) * w * h);
                             pixels = w * h;
+                            end = ptr + pixels;
                          }
                        else
                          {


Index: imlib2.spec
===================================================================
RCS file: /cvs/pkgs/rpms/imlib2/devel/imlib2.spec,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -r1.34 -r1.35
--- imlib2.spec	21 Oct 2008 11:22:14 -0000	1.34
+++ imlib2.spec	23 Nov 2008 10:19:15 -0000	1.35
@@ -1,13 +1,14 @@
 Summary:        Image loading, saving, rendering, and manipulation library
 Name:           imlib2
 Version:        1.4.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        Imlib2
 Group:          System Environment/Libraries
 URL:            http://docs.enlightenment.org/api/imlib2/html/
 Source0:        http://downloads.sourceforge.net/enlightenment/%{name}-%{version}.tar.bz2
 # Fedora specific multilib hack, upstream should switch to pkgconfig one day
 Patch0:         imlib2-1.3.0-multilib.patch
+Patch1:         imlib2-1.4.2-cve-2008-5187
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires:  libjpeg-devel libpng-devel libtiff-devel
 BuildRequires:  giflib-devel freetype-devel >= 2.1.9-4 libtool bzip2-devel
@@ -57,6 +58,7 @@
 %prep
 %setup -q
 %patch0 -p1 -b .multilib
+%patch1 -p1 -b .cve-2008-5187
 
 
 %build
@@ -121,6 +123,9 @@
 
 
 %changelog
+* Sun Nov 23 2008 Tomas Smetana <tsmetana at redhat.com> 1.4.2-2
+- patch for CVE-2008-5187
+
 * Tue Oct 21 2008 Tomas Smetana <tsmetana at redhat.com> 1.4.2-1
 - new upstream version 1.4.2