Tue Nov 6 14:03:00 2012 UTC ()
add 2 patches from upstream:
1e92e5235ded0415d555aa86066b8e4041ee5a53
and
4757cdf73d3675478d645a3ec8250ba02168a230
to fix integer overflow, leading to heap-based buffer overflow
in the ppm image reader (CVE-2012-4433)
bump PKGREV
(drochner)
diff -r1.40 -r1.41 pkgsrc/graphics/gegl/Makefile
diff -r1.12 -r1.13 pkgsrc/graphics/gegl/distinfo
diff -r0 -r1.1 pkgsrc/graphics/gegl/patches/patch-CVE-2012-4433
--- pkgsrc/graphics/gegl/Makefile 2012/10/08 23:00:54 1.40
+++ pkgsrc/graphics/gegl/Makefile 2012/11/06 14:03:00 1.41
| @@ -1,17 +1,17 @@ | | | @@ -1,17 +1,17 @@ |
1 | # $NetBSD: Makefile,v 1.40 2012/10/08 23:00:54 adam Exp $ | | 1 | # $NetBSD: Makefile,v 1.41 2012/11/06 14:03:00 drochner Exp $ |
2 | | | 2 | |
3 | DISTNAME= gegl-0.2.0 | | 3 | DISTNAME= gegl-0.2.0 |
4 | PKGREVISION= 6 | | 4 | PKGREVISION= 7 |
5 | CATEGORIES= graphics | | 5 | CATEGORIES= graphics |
6 | MASTER_SITES= ftp://ftp.gimp.org/pub/gegl/${PKGVERSION_NOREV:R}/ | | 6 | MASTER_SITES= ftp://ftp.gimp.org/pub/gegl/${PKGVERSION_NOREV:R}/ |
7 | EXTRACT_SUFX= .tar.bz2 | | 7 | EXTRACT_SUFX= .tar.bz2 |
8 | | | 8 | |
9 | MAINTAINER= adam@NetBSD.org | | 9 | MAINTAINER= adam@NetBSD.org |
10 | HOMEPAGE= http://gegl.org/ | | 10 | HOMEPAGE= http://gegl.org/ |
11 | COMMENT= Graph based image processing framework | | 11 | COMMENT= Graph based image processing framework |
12 | LICENSE= gnu-gpl-v3 | | 12 | LICENSE= gnu-gpl-v3 |
13 | | | 13 | |
14 | USE_LANGUAGES= c c++ | | 14 | USE_LANGUAGES= c c++ |
15 | USE_LIBTOOL= yes | | 15 | USE_LIBTOOL= yes |
16 | USE_TOOLS+= gmake pkg-config intltool msgfmt | | 16 | USE_TOOLS+= gmake pkg-config intltool msgfmt |
17 | GNU_CONFIGURE= yes | | 17 | GNU_CONFIGURE= yes |
--- pkgsrc/graphics/gegl/distinfo 2012/05/10 04:32:18 1.12
+++ pkgsrc/graphics/gegl/distinfo 2012/11/06 14:03:00 1.13
| @@ -1,6 +1,7 @@ | | | @@ -1,6 +1,7 @@ |
1 | $NetBSD: distinfo,v 1.12 2012/05/10 04:32:18 dholland Exp $ | | 1 | $NetBSD: distinfo,v 1.13 2012/11/06 14:03:00 drochner Exp $ |
2 | | | 2 | |
3 | SHA1 (gegl-0.2.0.tar.bz2) = 764cc66cb3c7b261b8fc18a6268a0e264a91d573 | | 3 | SHA1 (gegl-0.2.0.tar.bz2) = 764cc66cb3c7b261b8fc18a6268a0e264a91d573 |
4 | RMD160 (gegl-0.2.0.tar.bz2) = cc10365cff27dd42b002bf305f82de54d8c158fa | | 4 | RMD160 (gegl-0.2.0.tar.bz2) = cc10365cff27dd42b002bf305f82de54d8c158fa |
5 | Size (gegl-0.2.0.tar.bz2) = 7502040 bytes | | 5 | Size (gegl-0.2.0.tar.bz2) = 7502040 bytes |
| | | 6 | SHA1 (patch-CVE-2012-4433) = 0dd9f9714f92a511469433dcde1195371fcce580 |
6 | SHA1 (patch-aa) = 0f46061f7b0c213abfe422124839eec29780d039 | | 7 | SHA1 (patch-aa) = 0f46061f7b0c213abfe422124839eec29780d039 |
$NetBSD: patch-CVE-2012-4433,v 1.1 2012/11/06 14:03:00 drochner Exp $
see https://bugzilla.redhat.com/show_bug.cgi?id=856300
--- operations/external/ppm-load.c.orig 2012-03-29 20:05:50.000000000 +0000
+++ operations/external/ppm-load.c
@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "
#include "gegl-chant.h"
#include <stdio.h>
#include <stdlib.h>
+#include <errno.h>
typedef enum {
PIXMAP_ASCII = 51,
@@ -44,8 +45,8 @@ typedef enum {
typedef struct {
map_type type;
- gint width;
- gint height;
+ glong width;
+ glong height;
gsize numsamples; /* width * height * channels */
gsize bpc; /* bytes per channel */
guchar *data;
@@ -82,12 +83,33 @@ ppm_load_read_header(FILE *fp,
}
/* Get Width and Height */
- img->width = strtol (header,&ptr,0);
- img->height = atoi (ptr);
- img->numsamples = img->width * img->height * CHANNEL_COUNT;
+ errno = 0;
+ img->width = strtol (header,&ptr,10);
+ if (errno)
+ {
+ g_warning ("Error reading width: %s", strerror(errno));
+ return FALSE;
+ }
+ else if (img->width < 0)
+ {
+ g_warning ("Error: width is negative");
+ return FALSE;
+ }
+
+ img->height = strtol (ptr,&ptr,10);
+ if (errno)
+ {
+ g_warning ("Error reading height: %s", strerror(errno));
+ return FALSE;
+ }
+ else if (img->width < 0)
+ {
+ g_warning ("Error: height is negative");
+ return FALSE;
+ }
fgets (header,MAX_CHARS_IN_ROW,fp);
- maxval = strtol (header,&ptr,0);
+ maxval = strtol (header,&ptr,10);
if ((maxval != 255) && (maxval != 65535))
{
@@ -109,6 +131,16 @@ ppm_load_read_header(FILE *fp,
g_warning ("%s: Programmer stupidity error", G_STRLOC);
}
+ /* Later on, img->numsamples is multiplied with img->bpc to allocate
+ * memory. Ensure it doesn't overflow. */
+ if (!img->width || !img->height ||
+ G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+ {
+ g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
+ return FALSE;
+ }
+ img->numsamples = img->width * img->height * CHANNEL_COUNT;
+
return TRUE;
}
@@ -229,12 +261,24 @@ process (GeglOperation *operation,
if (!ppm_load_read_header (fp, &img))
goto out;
- rect.height = img.height;
- rect.width = img.width;
-
/* Allocating Array Size */
+
+ /* Should use g_try_malloc(), but this causes crashes elsewhere because the
+ * error signalled by returning FALSE isn't properly acted upon. Therefore
+ * g_malloc() is used here which aborts if the requested memory size can't be
+ * allocated causing a controlled crash. */
img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+ /* No-op without g_try_malloc(), see above. */
+ if (! img.data)
+ {
+ g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
+ goto out;
+ }
+
+ rect.height = img.height;
+ rect.width = img.width;
+
switch (img.bpc)
{
case 1: