diff options
author | drochner <drochner@pkgsrc.org> | 2012-11-06 14:03:00 +0000 |
---|---|---|
committer | drochner <drochner@pkgsrc.org> | 2012-11-06 14:03:00 +0000 |
commit | 4b549540517680d1f53417d233c32657102d21b6 (patch) | |
tree | c56de216dab044db2f2684b29fd13bd4d97f2e5b /graphics | |
parent | d9ecd3395b9484f9cea194a204f4e7c029df274e (diff) | |
download | pkgsrc-4b549540517680d1f53417d233c32657102d21b6.tar.gz |
add 2 patches from upstream:
1e92e5235ded0415d555aa86066b8e4041ee5a53
and
4757cdf73d3675478d645a3ec8250ba02168a230
to fix integer overflow, leading to heap-based buffer overflow
in the ppm image reader (CVE-2012-4433)
bump PKGREV
Diffstat (limited to 'graphics')
-rw-r--r-- | graphics/gegl/Makefile | 4 | ||||
-rw-r--r-- | graphics/gegl/distinfo | 3 | ||||
-rw-r--r-- | graphics/gegl/patches/patch-CVE-2012-4433 | 108 |
3 files changed, 112 insertions, 3 deletions
diff --git a/graphics/gegl/Makefile b/graphics/gegl/Makefile index ea3b23eac68..a1a62340965 100644 --- a/graphics/gegl/Makefile +++ b/graphics/gegl/Makefile @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.40 2012/10/08 23:00:54 adam Exp $ +# $NetBSD: Makefile,v 1.41 2012/11/06 14:03:00 drochner Exp $ DISTNAME= gegl-0.2.0 -PKGREVISION= 6 +PKGREVISION= 7 CATEGORIES= graphics MASTER_SITES= ftp://ftp.gimp.org/pub/gegl/${PKGVERSION_NOREV:R}/ EXTRACT_SUFX= .tar.bz2 diff --git a/graphics/gegl/distinfo b/graphics/gegl/distinfo index 85c0e72dd4f..22f7f533fa0 100644 --- a/graphics/gegl/distinfo +++ b/graphics/gegl/distinfo @@ -1,6 +1,7 @@ -$NetBSD: distinfo,v 1.12 2012/05/10 04:32:18 dholland Exp $ +$NetBSD: distinfo,v 1.13 2012/11/06 14:03:00 drochner Exp $ SHA1 (gegl-0.2.0.tar.bz2) = 764cc66cb3c7b261b8fc18a6268a0e264a91d573 RMD160 (gegl-0.2.0.tar.bz2) = cc10365cff27dd42b002bf305f82de54d8c158fa Size (gegl-0.2.0.tar.bz2) = 7502040 bytes +SHA1 (patch-CVE-2012-4433) = 0dd9f9714f92a511469433dcde1195371fcce580 SHA1 (patch-aa) = 0f46061f7b0c213abfe422124839eec29780d039 diff --git a/graphics/gegl/patches/patch-CVE-2012-4433 b/graphics/gegl/patches/patch-CVE-2012-4433 new file mode 100644 index 00000000000..803c03f0ba7 --- /dev/null +++ b/graphics/gegl/patches/patch-CVE-2012-4433 @@ -0,0 +1,108 @@ +$NetBSD: patch-CVE-2012-4433,v 1.1 2012/11/06 14:03:00 drochner Exp $ + +see https://bugzilla.redhat.com/show_bug.cgi?id=856300 + +--- operations/external/ppm-load.c.orig 2012-03-29 20:05:50.000000000 +0000 ++++ operations/external/ppm-load.c +@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), " + #include "gegl-chant.h" + #include <stdio.h> + #include <stdlib.h> ++#include <errno.h> + + typedef enum { + PIXMAP_ASCII = 51, +@@ -44,8 +45,8 @@ typedef enum { + + typedef struct { + map_type type; +- gint width; +- gint height; ++ glong width; ++ glong height; + gsize numsamples; /* width * height * channels */ + gsize bpc; /* bytes per channel */ + guchar *data; +@@ -82,12 +83,33 @@ ppm_load_read_header(FILE *fp, + } + + /* Get Width and Height */ +- img->width = strtol (header,&ptr,0); +- img->height = atoi (ptr); +- img->numsamples = img->width * img->height * CHANNEL_COUNT; ++ errno = 0; ++ img->width = strtol (header,&ptr,10); ++ if (errno) ++ { ++ g_warning ("Error reading width: %s", strerror(errno)); ++ return FALSE; ++ } ++ else if (img->width < 0) ++ { ++ g_warning ("Error: width is negative"); ++ return FALSE; ++ } ++ ++ img->height = strtol (ptr,&ptr,10); ++ if (errno) ++ { ++ g_warning ("Error reading height: %s", strerror(errno)); ++ return FALSE; ++ } ++ else if (img->width < 0) ++ { ++ g_warning ("Error: height is negative"); ++ return FALSE; ++ } + + fgets (header,MAX_CHARS_IN_ROW,fp); +- maxval = strtol (header,&ptr,0); ++ maxval = strtol (header,&ptr,10); + + if ((maxval != 255) && (maxval != 65535)) + { +@@ -109,6 +131,16 @@ ppm_load_read_header(FILE *fp, + g_warning ("%s: Programmer stupidity error", G_STRLOC); + } + ++ /* Later on, img->numsamples is multiplied with img->bpc to allocate ++ * memory. Ensure it doesn't overflow. */ ++ if (!img->width || !img->height || ++ G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc) ++ { ++ g_warning ("Illegal width/height: %ld/%ld", img->width, img->height); ++ return FALSE; ++ } ++ img->numsamples = img->width * img->height * CHANNEL_COUNT; ++ + return TRUE; + } + +@@ -229,12 +261,24 @@ process (GeglOperation *operation, + if (!ppm_load_read_header (fp, &img)) + goto out; + +- rect.height = img.height; +- rect.width = img.width; +- + /* Allocating Array Size */ ++ ++ /* Should use g_try_malloc(), but this causes crashes elsewhere because the ++ * error signalled by returning FALSE isn't properly acted upon. Therefore ++ * g_malloc() is used here which aborts if the requested memory size can't be ++ * allocated causing a controlled crash. */ + img.data = (guchar*) g_malloc (img.numsamples * img.bpc); + ++ /* No-op without g_try_malloc(), see above. */ ++ if (! img.data) ++ { ++ g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc)); ++ goto out; ++ } ++ ++ rect.height = img.height; ++ rect.width = img.width; ++ + switch (img.bpc) + { + case 1: |