Thu May 22 13:55:53 2014 UTC ()
Pullup ticket #4416 - requested by he
graphics/gimp: security patch
Revisions pulled up:
- graphics/gimp/Makefile 1.243 via patch
- graphics/gimp/distinfo 1.81-1.82
- graphics/gimp/patches/patch-plug-ins_common_file-xwd.c 1.1
---
Module Name: pkgsrc
Committed By: he
Date: Wed May 21 13:50:22 UTC 2014
Modified Files:
pkgsrc/graphics/gimp: Makefile distinfo
Added Files:
pkgsrc/graphics/gimp/patches: patch-plug-ins_common_file-xwd.c
Log Message:
Sanity check colormap size (CVE-2013-1913), valid range is 0 .. 256.
Sanity check # of colors and map entries (CVE-2013-1978)
From
https://git.gnome.org/browse/gimp/patch/?id=32ae0f83e5748299641cceaabe3f80f1b3afd03e
and
https://git.gnome.org/browse/gimp/patch/?id=23f685931e5f000dd033a45c60c1e60d7f78caf4
Bump PKGREVISION to 2.
---
Module Name: pkgsrc
Committed By: he
Date: Thu May 22 12:02:19 UTC 2014
Modified Files:
pkgsrc/graphics/gimp: distinfo
Log Message:
Uh-oh, forgot to update distinfo with new patch checksum.
(tron)
diff -r1.241 -r1.241.4.1 pkgsrc/graphics/gimp/Makefile
diff -r1.80 -r1.80.4.1 pkgsrc/graphics/gimp/distinfo
diff -r0 -r1.1.2.2 pkgsrc/graphics/gimp/patches/patch-plug-ins_common_file-xwd.c
--- pkgsrc/graphics/gimp/Makefile 2013/12/01 11:58:44 1.241
+++ pkgsrc/graphics/gimp/Makefile 2014/05/22 13:55:52 1.241.4.1
| @@ -1,16 +1,17 @@ | | | @@ -1,16 +1,17 @@ |
1 | # $NetBSD: Makefile,v 1.241 2013/12/01 11:58:44 adam Exp $ | | 1 | # $NetBSD: Makefile,v 1.241.4.1 2014/05/22 13:55:52 tron Exp $ |
2 | | | 2 | |
3 | DISTNAME= gimp-2.8.10 | | 3 | DISTNAME= gimp-2.8.10 |
| | | 4 | PKGREVISION= 2 |
4 | CATEGORIES= graphics | | 5 | CATEGORIES= graphics |
5 | MASTER_SITES= ftp://ftp.gimp.org/pub/gimp/v${PKGVERSION_NOREV:R}/ \ | | 6 | MASTER_SITES= ftp://ftp.gimp.org/pub/gimp/v${PKGVERSION_NOREV:R}/ \ |
6 | ${MASTER_SITE_GNU:=gimp/v${PKGVERSION_NOREV:R}/} \ | | 7 | ${MASTER_SITE_GNU:=gimp/v${PKGVERSION_NOREV:R}/} \ |
7 | ftp://ftp.gwdg.de/pub/misc/grafik/gimp/gimp/v${PKGVERSION_NOREV:R}/ | | 8 | ftp://ftp.gwdg.de/pub/misc/grafik/gimp/gimp/v${PKGVERSION_NOREV:R}/ |
8 | EXTRACT_SUFX= .tar.bz2 | | 9 | EXTRACT_SUFX= .tar.bz2 |
9 | | | 10 | |
10 | MAINTAINER= adam@NetBSD.org | | 11 | MAINTAINER= adam@NetBSD.org |
11 | HOMEPAGE= http://www.gimp.org/ | | 12 | HOMEPAGE= http://www.gimp.org/ |
12 | COMMENT= The GNU image manipulation program | | 13 | COMMENT= The GNU image manipulation program |
13 | LICENSE= gnu-lgpl-v2.1 AND gnu-gpl-v2 | | 14 | LICENSE= gnu-lgpl-v2.1 AND gnu-gpl-v2 |
14 | | | 15 | |
15 | BUILD_DEPENDS+= p5-XML-Parser>=2.31nb1:../../textproc/p5-XML-Parser | | 16 | BUILD_DEPENDS+= p5-XML-Parser>=2.31nb1:../../textproc/p5-XML-Parser |
16 | CONFLICTS+= gimp<=1.2.3 | | 17 | CONFLICTS+= gimp<=1.2.3 |
--- pkgsrc/graphics/gimp/distinfo 2013/12/15 08:25:38 1.80
+++ pkgsrc/graphics/gimp/distinfo 2014/05/22 13:55:52 1.80.4.1
| @@ -1,14 +1,15 @@ | | | @@ -1,14 +1,15 @@ |
1 | $NetBSD: distinfo,v 1.80 2013/12/15 08:25:38 markd Exp $ | | 1 | $NetBSD: distinfo,v 1.80.4.1 2014/05/22 13:55:52 tron Exp $ |
2 | | | 2 | |
3 | SHA1 (gimp-2.8.10.tar.bz2) = 6d3c98fcc86f42b0a825a5c62d5d3a5e1c83f48b | | 3 | SHA1 (gimp-2.8.10.tar.bz2) = 6d3c98fcc86f42b0a825a5c62d5d3a5e1c83f48b |
4 | RMD160 (gimp-2.8.10.tar.bz2) = c5364c49af2c695bc3d0bd97e792bf3ad75b1175 | | 4 | RMD160 (gimp-2.8.10.tar.bz2) = c5364c49af2c695bc3d0bd97e792bf3ad75b1175 |
5 | Size (gimp-2.8.10.tar.bz2) = 20343461 bytes | | 5 | Size (gimp-2.8.10.tar.bz2) = 20343461 bytes |
6 | SHA1 (patch-aa) = bc998a9510458e1f296c44ae26c8ee3900ce49ab | | 6 | SHA1 (patch-aa) = bc998a9510458e1f296c44ae26c8ee3900ce49ab |
7 | SHA1 (patch-ab) = 37820b9e03702248294f0030ffbd09e7f14f3dcb | | 7 | SHA1 (patch-ab) = 37820b9e03702248294f0030ffbd09e7f14f3dcb |
8 | SHA1 (patch-ad) = 7863678d59ccf54e2ce61a4ac4b883fb9eb5fb82 | | 8 | SHA1 (patch-ad) = 7863678d59ccf54e2ce61a4ac4b883fb9eb5fb82 |
9 | SHA1 (patch-app_Makefile.in) = 1677fa436f76d0b83bf048447fc025584a255e68 | | 9 | SHA1 (patch-app_Makefile.in) = 1677fa436f76d0b83bf048447fc025584a255e68 |
10 | SHA1 (patch-app_config_Makefile.in) = c5376f98649255b163cf9af448b5931d7675526c | | 10 | SHA1 (patch-app_config_Makefile.in) = c5376f98649255b163cf9af448b5931d7675526c |
11 | SHA1 (patch-app_text_gimpfont.c) = 723af05dc0d80a2ca20b2aee60f81e15bc5e71d1 | | 11 | SHA1 (patch-app_text_gimpfont.c) = 723af05dc0d80a2ca20b2aee60f81e15bc5e71d1 |
12 | SHA1 (patch-devel-docs_app_Makefile.in) = 89aec477783899cc6a5ac765d567d73f79474d5e | | 12 | SHA1 (patch-devel-docs_app_Makefile.in) = 89aec477783899cc6a5ac765d567d73f79474d5e |
13 | SHA1 (patch-plug-ins_common_file-mng.c) = 8ed244997cdef7125e1aa5da4d0fac5068ad5159 | | 13 | SHA1 (patch-plug-ins_common_file-mng.c) = 8ed244997cdef7125e1aa5da4d0fac5068ad5159 |
| | | 14 | SHA1 (patch-plug-ins_common_file-xwd.c) = ffe795b7a98e072f1993f6f452b510faa0d84ad5 |
14 | SHA1 (patch-plug-ins_script-fu_script-fu-server.c) = c424b1a8e345ec3d0763ac2cf1f8535da9e10797 | | 15 | SHA1 (patch-plug-ins_script-fu_script-fu-server.c) = c424b1a8e345ec3d0763ac2cf1f8535da9e10797 |
$NetBSD: patch-plug-ins_common_file-xwd.c,v 1.1.2.2 2014/05/22 13:55:53 tron Exp $
Sanity check colormap size (CVE-2013-1913), valid range is 0 .. 256.
Sanity check # of colors and map entries (CVE-2013-1978)
The number of colors in an image shouldn't be higher than the number of
colormap entries. Additionally, consolidate post error cleanup in
load_image().
From
https://git.gnome.org/browse/gimp/patch/?id=32ae0f83e5748299641cceaabe3f80f1b3afd03e
and
https://git.gnome.org/browse/gimp/patch/?id=23f685931e5f000dd033a45c60c1e60d7f78caf4
--- plug-ins/common/file-xwd.c.orig 2013-11-10 15:37:53.000000000 +0000
+++ plug-ins/common/file-xwd.c
@@ -424,9 +424,9 @@ static gint32
load_image (const gchar *filename,
GError **error)
{
- FILE *ifp;
+ FILE *ifp = NULL;
gint depth, bpp;
- gint32 image_ID;
+ gint32 image_ID = -1;
L_XWDFILEHEADER xwdhdr;
L_XWDCOLOR *xwdcolmap = NULL;
@@ -436,7 +436,7 @@ load_image (const gchar *filename,
g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),
_("Could not open '%s' for reading: %s"),
gimp_filename_to_utf8 (filename), g_strerror (errno));
- return -1;
+ goto out;
}
read_xwd_header (ifp, &xwdhdr);
@@ -445,8 +445,7 @@ load_image (const gchar *filename,
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("Could not read XWD header from '%s'"),
gimp_filename_to_utf8 (filename));
- fclose (ifp);
- return -1;
+ goto out;
}
#ifdef XWD_COL_WAIT_DEBUG
@@ -461,8 +460,25 @@ load_image (const gchar *filename,
/* Position to start of XWDColor structures */
fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET);
+ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only
+ * accepts colormaps with 0..256 colors anyway. */
+ if (xwdhdr.l_colormap_entries > 256)
+ {
+ g_message (_("'%s':\nIllegal number of colormap entries: %ld"),
+ gimp_filename_to_utf8 (filename),
+ (long)xwdhdr.l_colormap_entries);
+ goto out;
+ }
+
if (xwdhdr.l_colormap_entries > 0)
{
+ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)
+ {
+ g_message (_("'%s':\nNumber of colormap entries < number of colors"),
+ gimp_filename_to_utf8 (filename));
+ goto out;
+ }
+
xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
read_xwd_cols (ifp, &xwdhdr, xwdcolmap);
@@ -482,9 +498,7 @@ load_image (const gchar *filename,
if (xwdhdr.l_file_version != 7)
{
g_message (_("Can't read color entries"));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
}
@@ -492,9 +506,7 @@ load_image (const gchar *filename,
{
g_message (_("'%s':\nNo image width specified"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE
@@ -502,27 +514,21 @@ load_image (const gchar *filename,
{
g_message (_("'%s':\nImage width is larger than GIMP can handle"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_height <= 0)
{
g_message (_("'%s':\nNo image height specified"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)
{
g_message (_("'%s':\nImage height is larger than GIMP can handle"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
gimp_progress_init_printf (_("Opening '%s'"),
@@ -571,11 +577,6 @@ load_image (const gchar *filename,
}
gimp_progress_update (1.0);
- fclose (ifp);
-
- if (xwdcolmap)
- g_free (xwdcolmap);
-
if (image_ID == -1 && ! (error && *error))
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("XWD-file %s has format %d, depth %d and bits per pixel %d. "
@@ -583,6 +584,17 @@ load_image (const gchar *filename,
gimp_filename_to_utf8 (filename),
(gint) xwdhdr.l_pixmap_format, depth, bpp);
+out:
+ if (ifp)
+ {
+ fclose (ifp);
+ }
+
+ if (xwdcolmap)
+ {
+ g_free (xwdcolmap);
+ }
+
return image_ID;
}