Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/libwmf.git/tree/libwmf-0.2.8.4-CVE-2009-3546.patch

--- libwmf-0.2.8.4/src/extra/gd/gd_gd.c	2010-12-06 14:56:06.000000000 +0000
+++ libwmf-0.2.8.4/src/extra/gd/gd_gd.c	2010-12-06 14:57:04.000000000 +0000
@@ -42,6 +42,10 @@
 	    {
 	      goto fail1;
 	    }
+	  if (&im->colorsTotal > gdMaxColors)
+	    {
+	      goto fail1;
+	    }
 	}
       /* Int to accommodate truecolor single-color transparency */
       if (!gdGetInt (&im->transparent, in))
n'><a href='/'>index</a> : <a href='/guix/'>guix</a></td><td class='form'><form method='get'>
<input type='hidden' name='id' value='b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'/><select name='h' onchange='this.form.submit();'>
<option value='koszko' selected='selected'>koszko</option>
<option value='koszko-scripts'>koszko-scripts</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>Wojtek's customized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>refs</a><a class='active' href='/guix/log/gnu/packages/gperf.scm'>log</a><a href='/guix/tree/gnu/packages/gperf.scm?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>tree</a><a href='/guix/commit/gnu/packages/gperf.scm?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>commit</a><a href='/guix/diff/gnu/packages/gperf.scm?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/gperf.scm'>
<input type='hidden' name='id' value='b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>root</a>/<a href='/guix/log/gnu?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>gnu</a>/<a href='/guix/log/gnu/packages?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>packages</a>/<a href='/guix/log/gnu/packages/gperf.scm?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e'>gperf.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/gperf.scm?id=b8a6230df3fbbeeddb7a0e6976e0b8581bd0ab6e&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2017-03-30 22:59:53 +0200'>2017-03-30</span></td><td><a href='/guix/commit/gnu/packages/gperf.scm?id=84157bb8bf2c610584e0836047da4c710f8eaf76'>Merge branch 'master' into core-updates</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2017-03-30 01:30:16 +0200'>2017-03-30</span></td><td><a href='/guix/commit/gnu/packages/gperf.scm?id=6fd52309b8f52c9bb59fccffac53e029ce94b698'>gnu: Use HTTPS for almost all gnu.org HOME-PAGEs.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2017-03-19 23:42:57 +0100'>2017-03-19</span></td><td><a href='/guix/commit/gnu/packages/gperf.scm?id=4ed06287376bc1632c6bca4a395795bc8cc1b874'>gnu: elogind: Build with gperf 3.0.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-02-17 07:14:40 +0100'>2017-02-17</span></td><td><a href='/guix/commit/gnu/packages/gperf.scm?id=c5481600bbc27111f154e22c37ebc0824a575b26'>gnu: gperf: Update to 3.1</a><span class='msg-avail'>...</span></td><td>John Darrington</td></tr>