Branches for Hoary

Author: Martin Pitt
Revision Date: 2005-04-05 17:42:17 UTC

* SECURITY UPDATE: Fix Denial of Service with malformed images.
* gdk-pixbuf/io-bmp.c, grow_buffer(): Fix double free() leading
  to a crash with malicious BMP images.
* References:
  CAN-2005-0891

Author: Martin Pitt
Revision Date: 2005-11-16 11:14:03 UTC

* SECURITY UPDATE: Arbitrary code execution and DoS.
* Fix integer overflow in XPM loader:
  - gdk-pixbuf/io-xpm.c, pixbuf_create_from_xpm(): Check n_col for integer
    overflow before allocating memory.
  - XPMs with specially crafted number of colors can lead to buffer overflow
    and arbitrary code execution.
  - CVE-2005-3186
* Fix another integer overflow in XPM loader:
  - gdk-pixbuf/io-xpm.c, pixbuf_create_from_xpm(): Use gdk_pixbuf_new()
    instead of low-level allocation since the latter did not check for
    integer overflows (width * height * number of colors).
  - CVE-2005-2976
* Fix endless loop in XPM loader:
  - gdk-pixbuf/io-xpm.c, file_buffer(): Avoid endless loop with specially
    crafted number of colors.
  - CVE-2005-2975