aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-support/gd/gd
AgeCommit message (Collapse)Author
2020-03-21gd: fix CVE-2017-6363Haiqing Bai
Backport the CVE patch from the upstream to fix the heap-based buffer over-read in tiffWriter. Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-04gd: fix CVE-2019-6978Trevor Gamblin
CVE: CVE-2019-6978 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-09-12gd: Fix CVE-2018-1000222Mingli Yu
check return value in gdImageBmpPtr Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-06-20gd: Replace strncpy with memccpy to fix -Wstringop-truncation.Robert Yang
Fixed for gcc8: git/src/gdft.c:1699:2: error: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2017-08-28gd: update to 2.2.4Yi Zhao
* Remove the following patches which already merged in upstream: fix-gcc-unused-functions.patch .gitignore-the-new-test-case.patch CVE-2016-10166.patch CVE-2016-10167.patch CVE-2016-10168.patch CVE-2016-6906-1.patch CVE-2016-6906-2.patch Fix-290-TGA-RLE-decoding-is-broken.patch * Update LICENSE's MD5 check sum. The COPYING file has been update with the following commits in upstream: commit f863b3c2d300ff5344f6752e5813b0d6985e79c4 Resolve #282: COPYING vs. docs/naturaldocs/license.txt commit 9ccdaedbd9a2cfd1c8a9a258c09af161e796bd41 Sync COPYING and docs/naturaldocs/license.txt These two commits updated the copyright statement regarding the authorship of gd and adjust the format. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-06-05gd : CVE-2016-6906Catalin Enache
The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6906 Upstream patches: https://github.com/libgd/libgd/commit/fb0e0cce0b9f25389ab56604c3547351617e1415 https://github.com/libgd/libgd/commit/58b6dde319c301b0eae27d12e2a659e067d80558 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-04-18gd : CVE-2016-10167, CVE-2016-10168Catalin Enache
The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file. Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10167 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10168 Upstream patches: https://github.com/libgd/libgd/commit/fe9ed49dafa993e3af96b6a5a589efeea9bfb36f https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-04-18gd : CVE-2016-10166Catalin Enache
Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10166 Upstream patch: https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-01 15:54:39 +0000