From 1dae43d3c3a4b0dd215538eeb7e3ac6def92cfe8 Mon Sep 17 00:00:00 2001 From: tron Date: Thu, 22 May 2014 13:55:52 +0000 Subject: Pullup ticket #4416 - requested by he graphics/gimp: security patch Revisions pulled up: - graphics/gimp/Makefile 1.243 via patch - graphics/gimp/distinfo 1.81-1.82 - graphics/gimp/patches/patch-plug-ins_common_file-xwd.c 1.1 --- Module Name: pkgsrc Committed By: he Date: Wed May 21 13:50:22 UTC 2014 Modified Files: pkgsrc/graphics/gimp: Makefile distinfo Added Files: pkgsrc/graphics/gimp/patches: patch-plug-ins_common_file-xwd.c Log Message: Sanity check colormap size (CVE-2013-1913), valid range is 0 .. 256. Sanity check # of colors and map entries (CVE-2013-1978) From https://git.gnome.org/browse/gimp/patch/?id=32ae0f83e5748299641cceaabe3f80f1b3afd03e and https://git.gnome.org/browse/gimp/patch/?id=23f685931e5f000dd033a45c60c1e60d7f78caf4 Bump PKGREVISION to 2. --- Module Name: pkgsrc Committed By: he Date: Thu May 22 12:02:19 UTC 2014 Modified Files: pkgsrc/graphics/gimp: distinfo Log Message: Uh-oh, forgot to update distinfo with new patch checksum. --- graphics/gimp/Makefile | 3 +- graphics/gimp/distinfo | 3 +- .../gimp/patches/patch-plug-ins_common_file-xwd.c | 156 +++++++++++++++++++++ 3 files changed, 160 insertions(+), 2 deletions(-) create mode 100644 graphics/gimp/patches/patch-plug-ins_common_file-xwd.c diff --git a/graphics/gimp/Makefile b/graphics/gimp/Makefile index 171ce2f645c..fa77d010bc7 100644 --- a/graphics/gimp/Makefile +++ b/graphics/gimp/Makefile @@ -1,6 +1,7 @@ -# $NetBSD: Makefile,v 1.241 2013/12/01 11:58:44 adam Exp $ +# $NetBSD: Makefile,v 1.241.4.1 2014/05/22 13:55:52 tron Exp $ DISTNAME= gimp-2.8.10 +PKGREVISION= 2 CATEGORIES= graphics MASTER_SITES= ftp://ftp.gimp.org/pub/gimp/v${PKGVERSION_NOREV:R}/ \ ${MASTER_SITE_GNU:=gimp/v${PKGVERSION_NOREV:R}/} \ diff --git a/graphics/gimp/distinfo b/graphics/gimp/distinfo index 1a77f09eadd..b21af05ce86 100644 --- a/graphics/gimp/distinfo +++ b/graphics/gimp/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.80 2013/12/15 08:25:38 markd Exp $ +$NetBSD: distinfo,v 1.80.4.1 2014/05/22 13:55:52 tron Exp $ SHA1 (gimp-2.8.10.tar.bz2) = 6d3c98fcc86f42b0a825a5c62d5d3a5e1c83f48b RMD160 (gimp-2.8.10.tar.bz2) = c5364c49af2c695bc3d0bd97e792bf3ad75b1175 @@ -11,4 +11,5 @@ SHA1 (patch-app_config_Makefile.in) = c5376f98649255b163cf9af448b5931d7675526c SHA1 (patch-app_text_gimpfont.c) = 723af05dc0d80a2ca20b2aee60f81e15bc5e71d1 SHA1 (patch-devel-docs_app_Makefile.in) = 89aec477783899cc6a5ac765d567d73f79474d5e SHA1 (patch-plug-ins_common_file-mng.c) = 8ed244997cdef7125e1aa5da4d0fac5068ad5159 +SHA1 (patch-plug-ins_common_file-xwd.c) = ffe795b7a98e072f1993f6f452b510faa0d84ad5 SHA1 (patch-plug-ins_script-fu_script-fu-server.c) = c424b1a8e345ec3d0763ac2cf1f8535da9e10797 diff --git a/graphics/gimp/patches/patch-plug-ins_common_file-xwd.c b/graphics/gimp/patches/patch-plug-ins_common_file-xwd.c new file mode 100644 index 00000000000..776b1093fae --- /dev/null +++ b/graphics/gimp/patches/patch-plug-ins_common_file-xwd.c @@ -0,0 +1,156 @@ +$NetBSD: patch-plug-ins_common_file-xwd.c,v 1.1.2.2 2014/05/22 13:55:53 tron Exp $ + +Sanity check colormap size (CVE-2013-1913), valid range is 0 .. 256. +Sanity check # of colors and map entries (CVE-2013-1978) + +The number of colors in an image shouldn't be higher than the number of +colormap entries. Additionally, consolidate post error cleanup in +load_image(). + +From +https://git.gnome.org/browse/gimp/patch/?id=32ae0f83e5748299641cceaabe3f80f1b3afd03e +and +https://git.gnome.org/browse/gimp/patch/?id=23f685931e5f000dd033a45c60c1e60d7f78caf4 + +--- plug-ins/common/file-xwd.c.orig 2013-11-10 15:37:53.000000000 +0000 ++++ plug-ins/common/file-xwd.c +@@ -424,9 +424,9 @@ static gint32 + load_image (const gchar *filename, + GError **error) + { +- FILE *ifp; ++ FILE *ifp = NULL; + gint depth, bpp; +- gint32 image_ID; ++ gint32 image_ID = -1; + L_XWDFILEHEADER xwdhdr; + L_XWDCOLOR *xwdcolmap = NULL; + +@@ -436,7 +436,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Could not open '%s' for reading: %s"), + gimp_filename_to_utf8 (filename), g_strerror (errno)); +- return -1; ++ goto out; + } + + read_xwd_header (ifp, &xwdhdr); +@@ -445,8 +445,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Could not read XWD header from '%s'"), + gimp_filename_to_utf8 (filename)); +- fclose (ifp); +- return -1; ++ goto out; + } + + #ifdef XWD_COL_WAIT_DEBUG +@@ -461,8 +460,25 @@ load_image (const gchar *filename, + /* Position to start of XWDColor structures */ + fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + ++ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only ++ * accepts colormaps with 0..256 colors anyway. */ ++ if (xwdhdr.l_colormap_entries > 256) ++ { ++ g_message (_("'%s':\nIllegal number of colormap entries: %ld"), ++ gimp_filename_to_utf8 (filename), ++ (long)xwdhdr.l_colormap_entries); ++ goto out; ++ } ++ + if (xwdhdr.l_colormap_entries > 0) + { ++ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) ++ { ++ g_message (_("'%s':\nNumber of colormap entries < number of colors"), ++ gimp_filename_to_utf8 (filename)); ++ goto out; ++ } ++ + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); + + read_xwd_cols (ifp, &xwdhdr, xwdcolmap); +@@ -482,9 +498,7 @@ load_image (const gchar *filename, + if (xwdhdr.l_file_version != 7) + { + g_message (_("Can't read color entries")); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + } + +@@ -492,9 +506,7 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nNo image width specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE +@@ -502,27 +514,21 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nImage width is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height <= 0) + { + g_message (_("'%s':\nNo image height specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) + { + g_message (_("'%s':\nImage height is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + gimp_progress_init_printf (_("Opening '%s'"), +@@ -571,11 +577,6 @@ load_image (const gchar *filename, + } + gimp_progress_update (1.0); + +- fclose (ifp); +- +- if (xwdcolmap) +- g_free (xwdcolmap); +- + if (image_ID == -1 && ! (error && *error)) + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("XWD-file %s has format %d, depth %d and bits per pixel %d. " +@@ -583,6 +584,17 @@ load_image (const gchar *filename, + gimp_filename_to_utf8 (filename), + (gint) xwdhdr.l_pixmap_format, depth, bpp); + ++out: ++ if (ifp) ++ { ++ fclose (ifp); ++ } ++ ++ if (xwdcolmap) ++ { ++ g_free (xwdcolmap); ++ } ++ + return image_ID; + } + -- cgit v1.2.3