1 diff -ru Python-2.5-orig/Modules/imageop.c Python-2.5/Modules/imageop.c
2 --- Python-2.5-orig/Modules/imageop.c 2006-01-19 01:09:39.000000000 -0500
3 +++ Python-2.5/Modules/imageop.c 2007-10-19 01:11:33.000000000 -0400
8 - int len, size, x, y, newx1, newx2, newy1, newy2;
9 + int len, size, x, y, newx1, newx2, newy1, newy2, nlen;
10 int ix, iy, xstep, ystep;
14 PyErr_SetString(ImageopError, "Size should be 1, 2 or 4");
17 - if ( len != size*x*y ) {
18 + if (( len != size*x*y ) ||
19 + ( size != ((len / x) / y) )) {
20 PyErr_SetString(ImageopError, "String has incorrect length");
23 xstep = (newx1 < newx2)? 1 : -1;
24 ystep = (newy1 < newy2)? 1 : -1;
26 + nlen = (abs(newx2-newx1)+1)*(abs(newy2-newy1)+1)*size;
27 + if ( size != ((nlen / (abs(newx2-newx1)+1)) / (abs(newy2-newy1)+1)) ) {
28 + PyErr_SetString(ImageopError, "String has incorrect length");
31 rv = PyString_FromStringAndSize(NULL,
32 (abs(newx2-newx1)+1)*(abs(newy2-newy1)+1)*size);
38 - int len, size, x, y, newx, newy;
39 + int len, size, x, y, newx, newy, nlen;
44 PyErr_SetString(ImageopError, "Size should be 1, 2 or 4");
47 - if ( len != size*x*y ) {
48 + if ( ( len != size*x*y ) ||
49 + ( size != ((len / x) / y) ) ) {
50 + PyErr_SetString(ImageopError, "String has incorrect length");
53 + nlen = newx*newy*size;
54 + if ( size != ((nlen / newx) / newy) ) {
55 PyErr_SetString(ImageopError, "String has incorrect length");
59 - rv = PyString_FromStringAndSize(NULL, newx*newy*size);
60 + rv = PyString_FromStringAndSize(NULL, nlen);
63 ncp = (char *)PyString_AsString(rv);
65 PyErr_SetString(ImageopError, "Size should be 1 or 4");
68 - if ( maxx*maxy*width != len ) {
69 + if ( ( maxx*maxy*width != len ) ||
70 + ( maxx != ((len / maxy) / width) ) ) {
71 PyErr_SetString(ImageopError, "String has incorrect length");
75 if ( !PyArg_ParseTuple(args, "s#iii", &cp, &len, &x, &y, &tres) )
79 + if ( ( x*y != len ) ||
80 + ( x != len / y ) ) {
81 PyErr_SetString(ImageopError, "String has incorrect length");
85 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
89 + if ( ( x*y != len ) ||
90 + ( x != len / y ) ) {
91 PyErr_SetString(ImageopError, "String has incorrect length");
95 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
99 + if ( ( x*y != len ) ||
100 + ( x != len / y ) ) {
101 PyErr_SetString(ImageopError, "String has incorrect length");
105 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
108 - if ( x*y != len ) {
109 + if ( ( x*y != len ) ||
110 + ( x != len / y ) ) {
111 PyErr_SetString(ImageopError, "String has incorrect length");
115 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )
118 - if ( x*y != len ) {
119 + if ( ( x*y != len ) ||
120 + ( x != len / y ) ) {
121 PyErr_SetString(ImageopError, "String has incorrect length");
125 if ( !PyArg_ParseTuple(args, "s#iiii", &cp, &len, &x, &y, &v0, &v1) )
130 + if ( x != (nlen / y) ) {
131 + PyErr_SetString(ImageopError, "String has incorrect length");
134 if ( (nlen+7)/8 != len ) {
135 PyErr_SetString(ImageopError, "String has incorrect length");
141 + if ( x != (nlen / y) ) {
142 + PyErr_SetString(ImageopError, "String has incorrect length");
145 if ( (nlen+3)/4 != len ) {
146 PyErr_SetString(ImageopError, "String has incorrect length");
152 + if ( x != (nlen / y) ) {
153 + PyErr_SetString(ImageopError, "String has incorrect length");
156 if ( (nlen+1)/2 != len ) {
157 PyErr_SetString(ImageopError, "String has incorrect length");
163 + if ( x != (nlen / y) ) {
164 + PyErr_SetString(ImageopError, "String has incorrect length");
167 if ( nlen*4 != len ) {
168 PyErr_SetString(ImageopError, "String has incorrect length");
174 + if ( x != (nlen / y) ) {
175 + PyErr_SetString(ImageopError, "String has incorrect length");
179 PyErr_SetString(ImageopError, "String has incorrect length");
185 + if ( x != (nlen / y) ) {
186 + PyErr_SetString(ImageopError, "String has incorrect length");
189 if ( nlen*4 != len ) {
190 PyErr_SetString(ImageopError, "String has incorrect length");
196 + if ( x != (nlen / y) ) {
197 + PyErr_SetString(ImageopError, "String has incorrect length");
201 PyErr_SetString(ImageopError, "String has incorrect length");
203 Only in Python-2.5/Modules: imageop.c~
204 Only in Python-2.5/Modules: imageop.c.cve2007-4965
205 diff -ru Python-2.5-orig/Modules/rgbimgmodule.c Python-2.5/Modules/rgbimgmodule.c
206 --- Python-2.5-orig/Modules/rgbimgmodule.c 2006-08-11 23:18:50.000000000 -0400
207 +++ Python-2.5/Modules/rgbimgmodule.c 2007-10-19 01:05:44.000000000 -0400
212 + tablen = xsize * ysize * zsize * sizeof(Py_Int32);
213 + if (xsize != (((tablen / ysize) / zsize) / sizeof(Py_Int32))) {
218 tablen = ysize * zsize * sizeof(Py_Int32);
219 starttab = (Py_Int32 *)malloc(tablen);
220 Only in Python-2.5/Modules: rgbimgmodule.c.cve2007-4965
221 Only in Python-2.5/Modules: _tkinter.c.tkinter