francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
54 lines
2.3 KiB
Diff
54 lines
2.3 KiB
Diff
From a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25 Mon Sep 17 00:00:00 2001
|
|
From: Oblivionsage <cookieandcream560@gmail.com>
|
|
Date: Tue, 17 Mar 2026 08:55:18 +0100
|
|
Subject: [PATCH] fix: Initialize tail bytes in `trans_alpha` buffers
|
|
|
|
Although the arrays `info_ptr->trans_alpha` and `png_ptr->trans_alpha`
|
|
are allocated 256 bytes, only `num_trans` bytes are copied.
|
|
The remaining entries were left uninitialized. Set them to 0xff (fully
|
|
opaque) before copying, which matches the conventional treatment of
|
|
entries beyond `num_trans`.
|
|
|
|
This is a follow-up to the previous use-after-free fix.
|
|
|
|
CVE: CVE-2026-33416
|
|
Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25]
|
|
Comment: Refreshed hunk to match latest scarthgap
|
|
|
|
Reported-by: Cosmin Truta <ctruta@gmail.com>
|
|
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
|
|
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
|
|
Signed-off-by: Sourav Kumar Pramanik <Souravkumar.Pramanik@bmwtechworks.in>
|
|
Signed-off-by: Zahir Hussain <zahir.basha@kpit.com>
|
|
---
|
|
pngset.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/pngset.c b/pngset.c
|
|
index 47883684e4..dccc6498d7 100644
|
|
--- a/pngset.c
|
|
+++ b/pngset.c
|
|
@@ -994,9 +994,13 @@ png_set_tRNS(png_structrp png_ptr, png_i
|
|
|
|
if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
|
|
{
|
|
- /* Allocate info_ptr's copy of the transparency data. */
|
|
+ /* Allocate info_ptr's copy of the transparency data.
|
|
+ * Initialize all entries to fully opaque (0xff), then overwrite
|
|
+ * the first num_trans entries with the actual values.
|
|
+ */
|
|
info_ptr->trans_alpha = png_voidcast(png_bytep,
|
|
png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
|
|
+ memset(info_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH);
|
|
memcpy(info_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
|
|
info_ptr->free_me |= PNG_FREE_TRNS;
|
|
info_ptr->valid |= PNG_INFO_tRNS;
|
|
@@ -1013,6 +1017,7 @@ png_set_tRNS(png_structrp png_ptr, png_i
|
|
png_free(png_ptr, png_ptr->trans_alpha);
|
|
png_ptr->trans_alpha = png_voidcast(png_bytep,
|
|
png_malloc(png_ptr, PNG_MAX_PALETTE_LENGTH));
|
|
+ memset(png_ptr->trans_alpha, 0xff, PNG_MAX_PALETTE_LENGTH);
|
|
memcpy(png_ptr->trans_alpha, trans_alpha, (size_t)num_trans);
|
|
}
|
|
else
|