libgsf/sme8/libgsf_CVE-2006-4514.patch

===================================================================
RCS file: /cvs/gnome/libgsf/gsf/gsf-infile-msole.c,v
retrieving revision 1.73
retrieving revision 1.74
diff -u -r1.73 -r1.74
--- libgsf.orig/gsf/gsf-infile-msole.c  2006/09/06 20:39:46     1.73
+++ libgsf/gsf/gsf-infile-msole.c       2006/09/24 01:55:24     1.74
@@ -595,6 +595,13 @@
                        last = num_bat;
                } else if (num_metabat > 0) {
                        metabat_block = metabat[last];
+                       if (num_bat < last) {
+                               /* ::num_bat and ::num_metabat are
+                                * inconsistent.  There are too many metabats
+                                * for the bat count in the header. */
+                               ptr = NULL;
+                               break;
+                       }
                        num_bat -= last;
                }
 
1	slords	1.1	===================================================================
2			RCS file: /cvs/gnome/libgsf/gsf/gsf-infile-msole.c,v
3			retrieving revision 1.73
4			retrieving revision 1.74
5			diff -u -r1.73 -r1.74
6			--- libgsf.orig/gsf/gsf-infile-msole.c 2006/09/06 20:39:46 1.73
7			+++ libgsf/gsf/gsf-infile-msole.c 2006/09/24 01:55:24 1.74
8			@@ -595,6 +595,13 @@
9			last = num_bat;
10			} else if (num_metabat > 0) {
11			metabat_block = metabat[last];
12			+ if (num_bat < last) {
13			+ /* ::num_bat and ::num_metabat are
14			+ * inconsistent. There are too many metabats
15			+ * for the bat count in the header. */
16			+ ptr = NULL;
17			+ break;
18			+ }
19			num_bat -= last;
20			}
21