Re: [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024

[Leo Famulari <leo@famulari.name>]

On Fri, Apr 22, 2016 at 11:20:17PM -0400, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
> 
> > This applies from a patch from imlib2's source code repository.
> >
> > The change fixes an integer overflow on 32-bit machines. The upstream
> > says:
> >
> > Security implications:
> > *) for 32-bit machines: insufficient heap allocation and heap overwrite
> > in many image loaders, with escalation potential to remote code
> > execution;
> > *) for 64-bit machines: it seems, no impact.
> >
> > In the patch file, there are references to imlib2's source repo and the
> > CVE page on Mitre.
> >
> > I tested that feh and scrot still work with this change.
> 
> Looks good to me.  Please push.

Done as e993fb84