media-gfx/blender/files/blender-2.45-cve-2008-1102.patch


1
2
3
4
5
6
7
8
9
10
11
12
13

diff -up blender-2.45/source/blender/imbuf/intern/radiance_hdr.c.csv blender-2.45/source/blender/imbuf/intern/radiance_hdr.c
--- blender-2.45/source/blender/imbuf/intern/radiance_hdr.c.csv	2008-04-24 16:22:36.000000000 +0200
+++ blender-2.45/source/blender/imbuf/intern/radiance_hdr.c	2008-04-24 16:25:59.000000000 +0200
@@ -191,7 +191,8 @@ struct ImBuf *imb_loadhdr(unsigned char 
 			}
 		}
 		if (found) {
-			sscanf((char*)&mem[x+1], "%s %d %s %d", (char*)&oriY, &height, (char*)&oriX, &width);
+			if (sscanf((char *)&mem[x+1], "%79s %d %79s %d", (char*)&oriY, &height, 
+				(char*)&oriX, &width) != 4) return NULL;
 
 			/* find end of this line, data right behind it */
 			ptr = (unsigned char *)strchr((char*)&mem[x+1], '\n');