add patch from upstream to fix memory corruption when reading XWD files

bump PKGREV

3 files changed, 166 insertions, 3 deletions

diff --git a/graphics/gimp/Makefile b/graphics/gimp/Makefile
index 6c8059e04a1..0423fc1a81d 100644
--- a/graphics/gimp/Makefile
+++ b/graphics/gimp/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.225 2012/10/28 23:40:24 wiz Exp $
+# $NetBSD: Makefile,v 1.226 2012/11/23 15:43:13 drochner Exp $
 
 DISTNAME=	gimp-2.8.2
-PKGREVISION=	6
+PKGREVISION=	7
 CATEGORIES=	graphics
 MASTER_SITES=	ftp://ftp.gimp.org/pub/gimp/v${PKGVERSION_NOREV:R}/ \
 		${MASTER_SITE_GNU:=gimp/v${PKGVERSION_NOREV:R}/} \
diff --git a/graphics/gimp/distinfo b/graphics/gimp/distinfo
index d913f6d1dc2..e891ac4800f 100644
--- a/graphics/gimp/distinfo
+++ b/graphics/gimp/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.69 2012/09/07 19:16:45 adam Exp $
+$NetBSD: distinfo,v 1.70 2012/11/23 15:43:13 drochner Exp $
 
 SHA1 (gimp-2.8.2.tar.bz2) = 64ad90cedc5e8e348310b6eb6b7821ec110c0886
 RMD160 (gimp-2.8.2.tar.bz2) = 353cf862302417c35df902618a3ba05ac0b3af41
@@ -9,5 +9,6 @@ SHA1 (patch-ad) = 7863678d59ccf54e2ce61a4ac4b883fb9eb5fb82
 SHA1 (patch-app_Makefile.in) = efbd9e592cdbc154e5a6402279c7d54f3946c65c
 SHA1 (patch-app_base_base-utils.c) = 18dfa09c1d63530ff79cd4c3515d9f1077182d64
 SHA1 (patch-app_config_Makefile.in) = a2fcebd994831fbe0f911efb84c1fecdf2e59198
+SHA1 (patch-bug687392) = d5f15e1cf8b11ff2255fa470adf1f87f501d027c
 SHA1 (patch-devel-docs_app_Makefile.in) = 1eb97f779d5151b9e89b4ae47afb44d1bb3b6a48
 SHA1 (patch-plug-ins_script-fu_script-fu-server.c) = 4932d82711c8010cf7b1ff5bfb12031946273c2b
diff --git a/graphics/gimp/patches/patch-bug687392 b/graphics/gimp/patches/patch-bug687392
new file mode 100644
index 00000000000..2e9b6c40d1e
--- /dev/null
+++ b/graphics/gimp/patches/patch-bug687392
@@ -0,0 +1,162 @@
+$NetBSD: patch-bug687392,v 1.1 2012/11/23 15:43:13 drochner Exp $
+
+--- plug-ins/common/file-xwd.c.orig	2012-03-12 19:18:10.000000000 +0000
++++ plug-ins/common/file-xwd.c
+@@ -186,11 +186,13 @@ static gint32 load_xwd_f2_d16_b16 (const
+ static gint32 load_xwd_f2_d24_b32 (const gchar *,
+                                    FILE *,
+                                    L_XWDFILEHEADER *,
+-                                   L_XWDCOLOR *);
++                                   L_XWDCOLOR *,
++                                   GError **);
+ static gint32 load_xwd_f1_d24_b1  (const gchar *,
+                                    FILE *,
+                                    L_XWDFILEHEADER *,
+-                                   L_XWDCOLOR *);
++                                   L_XWDCOLOR *,
++                                   GError **);
+ 
+ static L_CARD32 read_card32  (FILE *,
+                               gint *);
+@@ -540,7 +542,8 @@ load_image (const gchar  *filename,
+     case 1:    /* Single plane pixmap */
+       if ((depth <= 24) && (bpp == 1))
+         {
+-          image_ID = load_xwd_f1_d24_b1 (filename, ifp, &xwdhdr, xwdcolmap);
++          image_ID = load_xwd_f1_d24_b1 (filename, ifp, &xwdhdr, xwdcolmap,
++                                         error);
+         }
+       break;
+ 
+@@ -559,7 +562,8 @@ load_image (const gchar  *filename,
+         }
+       else if ((depth <= 24) && ((bpp == 24) || (bpp == 32)))
+         {
+-          image_ID = load_xwd_f2_d24_b32 (filename, ifp, &xwdhdr, xwdcolmap);
++          image_ID = load_xwd_f2_d24_b32 (filename, ifp, &xwdhdr, xwdcolmap,
++                                          error);
+         }
+       break;
+     }
+@@ -570,7 +574,7 @@ load_image (const gchar  *filename,
+   if (xwdcolmap)
+     g_free (xwdcolmap);
+ 
+-  if (image_ID == -1)
++  if (image_ID == -1 && ! (error && *error))
+     g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                  _("XWD-file %s has format %d, depth %d and bits per pixel %d. "
+                    "Currently this is not supported."),
+@@ -1624,10 +1628,11 @@ load_xwd_f2_d16_b16 (const gchar     *fi
+ /* Load XWD with pixmap_format 2, pixmap_depth up to 24, bits_per_pixel 24/32 */
+ 
+ static gint32
+-load_xwd_f2_d24_b32 (const gchar     *filename,
+-                     FILE            *ifp,
+-                     L_XWDFILEHEADER *xwdhdr,
+-                     L_XWDCOLOR      *xwdcolmap)
++load_xwd_f2_d24_b32 (const gchar      *filename,
++                     FILE             *ifp,
++                     L_XWDFILEHEADER  *xwdhdr,
++                     L_XWDCOLOR       *xwdcolmap,
++                     GError          **error)
+ {
+   register guchar *dest, lsbyte_first;
+   gint             width, height, linepad, i, j, c0, c1, c2, c3;
+@@ -1652,12 +1657,6 @@ load_xwd_f2_d24_b32 (const gchar     *fi
+   width  = xwdhdr->l_pixmap_width;
+   height = xwdhdr->l_pixmap_height;
+ 
+-  image_ID = create_new_image (filename, width, height, GIMP_RGB,
+-                               &layer_ID, &drawable, &pixel_rgn);
+-
+-  tile_height = gimp_tile_height ();
+-  data = g_malloc (tile_height * width * 3);
+-
+   redmask   = xwdhdr->l_red_mask;
+   greenmask = xwdhdr->l_green_mask;
+   bluemask  = xwdhdr->l_blue_mask;
+@@ -1685,6 +1684,22 @@ load_xwd_f2_d24_b32 (const gchar     *fi
+   maxblue = 0; while (bluemask >> (blueshift + maxblue)) maxblue++;
+   maxblue = (1 << maxblue) - 1;
+ 
++  if (maxred   > sizeof (redmap)   ||
++      maxgreen > sizeof (greenmap) ||
++      maxblue  > sizeof (bluemap))
++    {
++      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
++                   _("XWD-file %s is corrupt."),
++                   gimp_filename_to_utf8 (filename));
++      return -1;
++    }
++
++  image_ID = create_new_image (filename, width, height, GIMP_RGB,
++                               &layer_ID, &drawable, &pixel_rgn);
++
++  tile_height = gimp_tile_height ();
++  data = g_malloc (tile_height * width * 3);
++
+   /* Set map-arrays for red, green, blue */
+   for (red = 0; red <= maxred; red++)
+     redmap[red] = (red * 255) / maxred;
+@@ -1825,10 +1840,11 @@ load_xwd_f2_d24_b32 (const gchar     *fi
+ /* Load XWD with pixmap_format 1, pixmap_depth up to 24, bits_per_pixel 1 */
+ 
+ static gint32
+-load_xwd_f1_d24_b1 (const gchar     *filename,
+-                    FILE            *ifp,
+-                    L_XWDFILEHEADER *xwdhdr,
+-                    L_XWDCOLOR      *xwdcolmap)
++load_xwd_f1_d24_b1 (const gchar      *filename,
++                    FILE             *ifp,
++                    L_XWDFILEHEADER  *xwdhdr,
++                    L_XWDCOLOR       *xwdcolmap,
++                    GError          **error)
+ {
+   register guchar *dest, outmask, inmask, do_reverse;
+   gint             width, height, i, j, plane, fromright;
+@@ -1863,13 +1879,6 @@ load_xwd_f1_d24_b1 (const gchar     *fil
+   indexed         = (xwdhdr->l_pixmap_depth <= 8);
+   bytes_per_pixel = (indexed ? 1 : 3);
+ 
+-  image_ID = create_new_image (filename, width, height,
+-                               indexed ? GIMP_INDEXED : GIMP_RGB,
+-                               &layer_ID, &drawable, &pixel_rgn);
+-
+-  tile_height = gimp_tile_height ();
+-  data = g_malloc (tile_height * width * bytes_per_pixel);
+-
+   for (j = 0; j < 256; j++)   /* Create an array for reversing bits */
+     {
+       inmask = 0;
+@@ -1913,6 +1922,16 @@ load_xwd_f1_d24_b1 (const gchar     *fil
+       maxblue = 0; while (bluemask >> (blueshift + maxblue)) maxblue++;
+       maxblue = (1 << maxblue) - 1;
+ 
++      if (maxred   > sizeof (redmap)   ||
++          maxgreen > sizeof (greenmap) ||
++          maxblue  > sizeof (bluemap))
++        {
++          g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
++                       _("XWD-file %s is corrupt."),
++                       gimp_filename_to_utf8 (filename));
++          return -1;
++        }
++
+       /* Set map-arrays for red, green, blue */
+       for (red = 0; red <= maxred; red++)
+         redmap[red] = (red * 255) / maxred;
+@@ -1922,6 +1941,13 @@ load_xwd_f1_d24_b1 (const gchar     *fil
+         bluemap[blue] = (blue * 255) / maxblue;
+     }
+ 
++  image_ID = create_new_image (filename, width, height,
++                               indexed ? GIMP_INDEXED : GIMP_RGB,
++                               &layer_ID, &drawable, &pixel_rgn);
++
++  tile_height = gimp_tile_height ();
++  data = g_malloc (tile_height * width * bytes_per_pixel);
++
+   ncols = xwdhdr->l_colormap_entries;
+   if (xwdhdr->l_ncolors < ncols)
+     ncols = xwdhdr->l_ncolors;