From 6afc94817baf13a06ec551f36884afb7b45a5bff Mon Sep 17 00:00:00 2001 From: Thomas Penteker Date: Mon, 9 Dec 2013 23:34:05 +0100 Subject: gimp: include cve patches --- gimp/cve-2013-1913 | 30 +++++++++++ gimp/cve-2013-1978 | 150 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 180 insertions(+) create mode 100644 gimp/cve-2013-1913 create mode 100644 gimp/cve-2013-1978 (limited to 'gimp') diff --git a/gimp/cve-2013-1913 b/gimp/cve-2013-1913 new file mode 100644 index 000000000..17bebe9e5 --- /dev/null +++ b/gimp/cve-2013-1913 @@ -0,0 +1,30 @@ +From 32ae0f83e5748299641cceaabe3f80f1b3afd03e Mon Sep 17 00:00:00 2001 +From: Nils Philippsen +Date: Thu, 14 Nov 2013 13:29:01 +0000 +Subject: file-xwd: sanity check colormap size (CVE-2013-1913) + +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index c8e1a6e..343129a 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -466,6 +466,17 @@ load_image (const gchar *filename, + /* Position to start of XWDColor structures */ + fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + ++ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only ++ * accepts colormaps with 0..256 colors anyway. */ ++ if (xwdhdr.l_colormap_entries > 256) ++ { ++ g_message (_("'%s':\nIllegal number of colormap entries: %ld"), ++ gimp_filename_to_utf8 (filename), ++ (long)xwdhdr.l_colormap_entries); ++ fclose (ifp); ++ return -1; ++ } ++ + if (xwdhdr.l_colormap_entries > 0) + { + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); +-- +cgit v0.9.2 diff --git a/gimp/cve-2013-1978 b/gimp/cve-2013-1978 new file mode 100644 index 000000000..48f9123d9 --- /dev/null +++ b/gimp/cve-2013-1978 @@ -0,0 +1,150 @@ +From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001 +From: Nils Philippsen +Date: Tue, 26 Nov 2013 09:49:42 +0000 +Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978) + +The number of colors in an image shouldn't be higher than the number of +colormap entries. Additionally, consolidate post error cleanup in +load_image(). +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index 343129a..4df9ce8 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -429,9 +429,9 @@ static gint32 + load_image (const gchar *filename, + GError **error) + { +- FILE *ifp; ++ FILE *ifp = NULL; + gint depth, bpp; +- gint32 image_ID; ++ gint32 image_ID = -1; + L_XWDFILEHEADER xwdhdr; + L_XWDCOLOR *xwdcolmap = NULL; + +@@ -441,7 +441,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Could not open '%s' for reading: %s"), + gimp_filename_to_utf8 (filename), g_strerror (errno)); +- return -1; ++ goto out; + } + + read_xwd_header (ifp, &xwdhdr); +@@ -450,8 +450,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Could not read XWD header from '%s'"), + gimp_filename_to_utf8 (filename)); +- fclose (ifp); +- return -1; ++ goto out; + } + + #ifdef XWD_COL_WAIT_DEBUG +@@ -473,12 +472,18 @@ load_image (const gchar *filename, + g_message (_("'%s':\nIllegal number of colormap entries: %ld"), + gimp_filename_to_utf8 (filename), + (long)xwdhdr.l_colormap_entries); +- fclose (ifp); +- return -1; ++ goto out; + } + + if (xwdhdr.l_colormap_entries > 0) + { ++ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) ++ { ++ g_message (_("'%s':\nNumber of colormap entries < number of colors"), ++ gimp_filename_to_utf8 (filename)); ++ goto out; ++ } ++ + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); + + read_xwd_cols (ifp, &xwdhdr, xwdcolmap); +@@ -498,9 +503,7 @@ load_image (const gchar *filename, + if (xwdhdr.l_file_version != 7) + { + g_message (_("Can't read color entries")); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + } + +@@ -508,9 +511,7 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nNo image width specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE +@@ -518,27 +519,21 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nImage width is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height <= 0) + { + g_message (_("'%s':\nNo image height specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) + { + g_message (_("'%s':\nImage height is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + gimp_progress_init_printf (_("Opening '%s'"), +@@ -591,11 +586,6 @@ load_image (const gchar *filename, + } + gimp_progress_update (1.0); + +- fclose (ifp); +- +- if (xwdcolmap) +- g_free (xwdcolmap); +- + if (image_ID == -1 && ! (error && *error)) + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("XWD-file %s has format %d, depth %d and bits per pixel %d. " +@@ -603,6 +593,17 @@ load_image (const gchar *filename, + gimp_filename_to_utf8 (filename), + (gint) xwdhdr.l_pixmap_format, depth, bpp); + ++out: ++ if (ifp) ++ { ++ fclose (ifp); ++ } ++ ++ if (xwdcolmap) ++ { ++ g_free (xwdcolmap); ++ } ++ + return image_ID; + } + +-- +cgit v0.9.2 -- cgit v1.2.3