20b7bbefae
Sun Jul 26 2009 Kevin Kofler <Kevin@tigcc.ticalc.org> - 3.5.10-13
- fix CVE-2009-2537 - select length DoS
- fix CVE-2009-1725 - crash, possible ACE in numeric character references
- fix CVE-2009-1690 - crash, possible ACE in KHTML (<head> use-after-free)
- fix CVE-2009-1687 - possible ACE in KJS (FIXME: still crashes?)
- fix CVE-2009-1698 - crash, possible ACE in CSS style attribute handling
Fri Jul 24 2009 Fedora Release Engineering
<rel-eng@lists.fedoraproject.org> - 3.5.10-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
Sat Jul 18 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-12
- FTBFS kdelibs3-3.5.10-11.fc11 (#511571)
- -devel: Requires: %%{name}%%_isa ...
Sun Apr 19 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-11
- update openssl patch (for 0.9.8k)
Thu Apr 16 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-10
- move designer plugins to runtime (#487622)
- make -apidocs noarch
Mon Mar 02 2009 Than Ngo <than@redhat.com> - 3.5.10-9
- enable -apidocs
Fri Feb 27 2009 Rex Dieter <rdieter@fedoraproject.org> - 3.5.10-8
- disable -apidocs (f11+, #487719)
- cleanup unused kdeui_symlink hack baggage
Wed Feb 25 2009 Than Ngo <than@redhat.com> - 3.5.10-7
- fix files conflicts with 4.2.x
- fix build issue with gcc-4.4
Wed Feb 25 2009 Fedora Release Engineering
<rel-eng@lists.fedoraproject.org> - 3.5.10-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
3.5.10-5
- unowned dirs (#483318)
3.5.10-4
- Slight speedup to profile.d/kde.sh (#465370).
21 lines
769 B
Diff
21 lines
769 B
Diff
--- kdelibs-3.5.4/kjs/collector.cpp.CVE-2009-1687 2009-06-17 15:07:33.000000000 +0200
|
|
+++ kdelibs-3.5.4/kjs/collector.cpp 2009-06-20 00:42:48.000000000 +0200
|
|
@@ -23,6 +23,7 @@
|
|
|
|
#include "value.h"
|
|
#include "internal.h"
|
|
+#include <limits.h>
|
|
|
|
#ifndef MAX
|
|
#define MAX(a,b) ((a) > (b) ? (a) : (b))
|
|
@@ -119,6 +120,9 @@
|
|
// didn't find one, need to allocate a new block
|
|
|
|
if (heap.usedBlocks == heap.numBlocks) {
|
|
+ static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
|
|
+ if (heap.numBlocks > maxNumBlocks)
|
|
+ return 0L;
|
|
heap.numBlocks = MAX(MIN_ARRAY_SIZE, heap.numBlocks * GROWTH_FACTOR);
|
|
heap.blocks = (CollectorBlock **)realloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock *));
|
|
}
|