--- graphics/gd/Makefile (working copy) +++ graphics/gd/Makefile (working copy) @@ -3,7 +3,7 @@ PORTNAME= libgd PORTVERSION= 2.2.3 -PORTREVISION?= 0 +PORTREVISION?= 1 PORTEPOCH= 1 CATEGORIES+= graphics MASTER_SITES= https://github.com/${PORTNAME}/${PORTNAME}/releases/download/gd-${PORTVERSION}/ --- graphics/gd/files/patch-src_gd__webp.c (working copy) +++ graphics/gd/files/patch-src_gd__webp.c (working copy) @@ -0,0 +1,27 @@ +LibGD Issue: https://github.com/libgd/libgd/issues/308 +Commit: https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03 + +Fix integer overflow in gdImageWebpCtx + +Integer overflow can be happened in expression gdImageSX(im) * 4 * +gdImageSY(im). It could lead to heap buffer overflow in the following +code. This issue has been reported to the PHP Bug Tracking System. The +proof-of-concept file will be supplied some days later. This issue was +discovered by Ke Liu of Tencent's Xuanwu LAB. +--- src/gd_webp.c.orig 2016-07-21 08:06:42 UTC ++++ src/gd_webp.c +@@ -126,6 +126,14 @@ void gdImageWebpCtx (gdImagePtr im, gdIO + quantization = 80; + } + ++ if (overflow2(gdImageSX(im), 4)) { ++ return; ++ } ++ ++ if (overflow2(gdImageSX(im) * 4, gdImageSY(im))) { ++ return; ++ } ++ + argb = (uint8_t *)gdMalloc(gdImageSX(im) * 4 * gdImageSY(im)); + if (!argb) { + return;