libgsf/sme8/libgsf_CVE-2006-4514.patch

===================================================================
RCS file: /cvs/gnome/libgsf/gsf/gsf-infile-msole.c,v
retrieving revision 1.73
retrieving revision 1.74
diff -u -r1.73 -r1.74
--- libgsf.orig/gsf/gsf-infile-msole.c  2006/09/06 20:39:46     1.73
+++ libgsf/gsf/gsf-infile-msole.c       2006/09/24 01:55:24     1.74
@@ -595,6 +595,13 @@
                        last = num_bat;
                } else if (num_metabat > 0) {
                        metabat_block = metabat[last];
+                       if (num_bat < last) {
+                               /* ::num_bat and ::num_metabat are
+                                * inconsistent.  There are too many metabats
+                                * for the bat count in the header. */
+                               ptr = NULL;
+                               break;
+                       }
                        num_bat -= last;
                }
 
1	===================================================================
2	RCS file: /cvs/gnome/libgsf/gsf/gsf-infile-msole.c,v
3	retrieving revision 1.73
4	retrieving revision 1.74
5	diff -u -r1.73 -r1.74
6	--- libgsf.orig/gsf/gsf-infile-msole.c 2006/09/06 20:39:46 1.73
7	+++ libgsf/gsf/gsf-infile-msole.c 2006/09/24 01:55:24 1.74
8	@@ -595,6 +595,13 @@
9	last = num_bat;
10	} else if (num_metabat > 0) {
11	metabat_block = metabat[last];
12	+ if (num_bat < last) {
13	+ /* ::num_bat and ::num_metabat are
14	+ * inconsistent. There are too many metabats
15	+ * for the bat count in the header. */
16	+ ptr = NULL;
17	+ break;
18	+ }
19	num_bat -= last;
20	}
21