From dc48d5c020c0795c966501b83ac2d4b4ae0e4caa Mon Sep 17 00:00:00 2001
From: Kei Kebreau <address@hidden>
Date: Sat, 15 Oct 2016 15:57:21 -0400
Subject: [PATCH] gnu: gd: Fix CVE-2016-8670.

* gnu/packages/patches/gd-CVE-2016-8670.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gd.scm (gd)[source]: Use it.
---
 gnu/local.mk                                |  1 +
 gnu/packages/gd.scm                         |  1 +
 gnu/packages/patches/gd-CVE-2016-8670.patch | 12 ++++++++++++
 3 files changed, 14 insertions(+)
 create mode 100644 gnu/packages/patches/gd-CVE-2016-8670.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index a151d2b..68b4bf3 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -536,6 +536,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/gcc-libvtv-runpath.patch			\
   %D%/packages/patches/gcc-5.0-libvtv-runpath.patch		\
   %D%/packages/patches/gd-CVE-2016-7568.patch			\
+  %D%/packages/patches/gd-CVE-2016-8670.patch			\
   %D%/packages/patches/gd-fix-gd2-read-test.patch		\
   %D%/packages/patches/gd-fix-tests-on-i686.patch		\
   %D%/packages/patches/gegl-CVE-2012-4433.patch			\
diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm
index 6c94d35..0241a81 100644
--- a/gnu/packages/gd.scm
+++ b/gnu/packages/gd.scm
@@ -51,6 +51,7 @@
               (base32
                "0g3xz8jpz1pl2zzmssglrpa9nxiaa7rmcmvgpbrjz8k9cyynqsvl"))
              (patches (search-patches "gd-CVE-2016-7568.patch"
+                                      "gd-CVE-2016-8670.patch"
                                       "gd-fix-gd2-read-test.patch"
                                       "gd-fix-tests-on-i686.patch"))))
     (build-system gnu-build-system)
diff --git a/gnu/packages/patches/gd-CVE-2016-8670.patch b/gnu/packages/patches/gd-CVE-2016-8670.patch
new file mode 100644
index 0000000..21d5fd9
--- /dev/null
+++ b/gnu/packages/patches/gd-CVE-2016-8670.patch
@@ -0,0 +1,12 @@
+diff -u -r libgd-2.2.3.old/src/gd_io_dp.c libgd-2.2.3/src/gd_io_dp.c
+--- libgd-2.2.3.old/src/gd_io_dp.c	1969-12-31 19:00:00.000000000 -0500
++++ libgd-2.2.3/src/gd_io_dp.c	2016-10-15 15:49:04.478163658 -0400
+@@ -276,7 +276,7 @@
+ 	if(remain >= len) {
+ 		rlen = len;
+ 	} else {
+-		if(remain == 0) {
++		if(remain <= 0) {
+ 			/* 2.0.34: EOF is incorrect. We use 0 for
+ 			 * errors and EOF, just like fileGetbuf,
+ 			 * which is a simple fread() wrapper.
-- 
2.10.1