cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security fix for CVE-2012-5576,

Browse Source 
Memory corruption vulnerability when reading XWD files

ok giovanni@ (MAINTAINER)
This commit is contained in:
jasper 2012-11-27 12:12:41 +00:00
parent 51be9d1bda
commit 8b17f2b447
2 changed files with 171 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
graphics/gimp/stable/Makefile
View File

@ -1,10 +1,11 @@
# $OpenBSD: Makefile,v 1.83 2012/10/02 13:10:44 giovanni Exp $
# $OpenBSD: Makefile,v 1.84 2012/11/27 12:12:41 jasper Exp $
COMMENT= GNU Image Manipulation Program
SHARED_ONLY= Yes
DISTNAME= gimp-2.8.2
REVISION= 0
SHARED_LIBS+= gimp-2.0 272.0 # 800.0
SHARED_LIBS+= gimpbase-2.0 272.0 # 800.0

169
graphics/gimp/stable/patches/patch-plug-ins_common_file-xwd_c Normal file
View File

@ -0,0 +1,169 @@
$OpenBSD: patch-plug-ins_common_file-xwd_c,v 1.1 2012/11/27 12:12:41 jasper Exp $
From 2873262fccba12af144ed96ed91be144d92ff2e1 Mon Sep 17 00:00:00 2001
From: Michael Natterer <mitch@gimp.org>
Date: Wed, 07 Nov 2012 23:16:31 +0000
Subject: Bug 687392 - Memory corruption vulnerability when reading XWD files
CVE-2012-5576
--- plug-ins/common/file-xwd.c.orig Mon Mar 12 20:18:10 2012
+++ plug-ins/common/file-xwd.c Tue Nov 27 10:06:22 2012
@@ -186,11 +186,13 @@ static gint32 load_xwd_f2_d16_b16 (const gchar *,
static gint32 load_xwd_f2_d24_b32 (const gchar *,
FILE *,
L_XWDFILEHEADER *,
- L_XWDCOLOR *);
+ L_XWDCOLOR *,
+ GError **);
static gint32 load_xwd_f1_d24_b1 (const gchar *,
FILE *,
L_XWDFILEHEADER *,
- L_XWDCOLOR *);
+ L_XWDCOLOR *,
+ GError **);
static L_CARD32 read_card32 (FILE *,
gint *);
@@ -540,7 +542,8 @@ load_image (const gchar *filename,
case 1: /* Single plane pixmap */
if ((depth <= 24) && (bpp == 1))
{
- image_ID = load_xwd_f1_d24_b1 (filename, ifp, &xwdhdr, xwdcolmap);
+ image_ID = load_xwd_f1_d24_b1 (filename, ifp, &xwdhdr, xwdcolmap,
+ error);
}
break;
@@ -559,7 +562,8 @@ load_image (const gchar *filename,
}
else if ((depth <= 24) && ((bpp == 24) || (bpp == 32)))
{
- image_ID = load_xwd_f2_d24_b32 (filename, ifp, &xwdhdr, xwdcolmap);
+ image_ID = load_xwd_f2_d24_b32 (filename, ifp, &xwdhdr, xwdcolmap,
+ error);
}
break;
}
@@ -570,7 +574,7 @@ load_image (const gchar *filename,
if (xwdcolmap)
g_free (xwdcolmap);
- if (image_ID == -1)
+ if (image_ID == -1 && ! (error && *error))
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("XWD-file %s has format %d, depth %d and bits per pixel %d. "
"Currently this is not supported."),
@@ -1624,10 +1628,11 @@ load_xwd_f2_d16_b16 (const gchar *filename,
/* Load XWD with pixmap_format 2, pixmap_depth up to 24, bits_per_pixel 24/32 */
static gint32
-load_xwd_f2_d24_b32 (const gchar *filename,
- FILE *ifp,
- L_XWDFILEHEADER *xwdhdr,
- L_XWDCOLOR *xwdcolmap)
+load_xwd_f2_d24_b32 (const gchar *filename,
+ FILE *ifp,
+ L_XWDFILEHEADER *xwdhdr,
+ L_XWDCOLOR *xwdcolmap,
+ GError **error)
{
register guchar *dest, lsbyte_first;
gint width, height, linepad, i, j, c0, c1, c2, c3;
@@ -1652,12 +1657,6 @@ load_xwd_f2_d24_b32 (const gchar *filename,
width = xwdhdr->l_pixmap_width;
height = xwdhdr->l_pixmap_height;
- image_ID = create_new_image (filename, width, height, GIMP_RGB,
- &layer_ID, &drawable, &pixel_rgn);
-
- tile_height = gimp_tile_height ();
- data = g_malloc (tile_height * width * 3);
-
redmask = xwdhdr->l_red_mask;
greenmask = xwdhdr->l_green_mask;
bluemask = xwdhdr->l_blue_mask;
@@ -1685,6 +1684,22 @@ load_xwd_f2_d24_b32 (const gchar *filename,
maxblue = 0; while (bluemask >> (blueshift + maxblue)) maxblue++;
maxblue = (1 << maxblue) - 1;
+ if (maxred > sizeof (redmap) ||
+ maxgreen > sizeof (greenmap) ||
+ maxblue > sizeof (bluemap))
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("XWD-file %s is corrupt."),
+ gimp_filename_to_utf8 (filename));
+ return -1;
+ }
+
+ image_ID = create_new_image (filename, width, height, GIMP_RGB,
+ &layer_ID, &drawable, &pixel_rgn);
+
+ tile_height = gimp_tile_height ();
+ data = g_malloc (tile_height * width * 3);
+
/* Set map-arrays for red, green, blue */
for (red = 0; red <= maxred; red++)
redmap[red] = (red * 255) / maxred;
@@ -1825,10 +1840,11 @@ load_xwd_f2_d24_b32 (const gchar *filename,
/* Load XWD with pixmap_format 1, pixmap_depth up to 24, bits_per_pixel 1 */
static gint32
-load_xwd_f1_d24_b1 (const gchar *filename,
- FILE *ifp,
- L_XWDFILEHEADER *xwdhdr,
- L_XWDCOLOR *xwdcolmap)
+load_xwd_f1_d24_b1 (const gchar *filename,
+ FILE *ifp,
+ L_XWDFILEHEADER *xwdhdr,
+ L_XWDCOLOR *xwdcolmap,
+ GError **error)
{
register guchar *dest, outmask, inmask, do_reverse;
gint width, height, i, j, plane, fromright;
@@ -1863,13 +1879,6 @@ load_xwd_f1_d24_b1 (const gchar *filename,
indexed = (xwdhdr->l_pixmap_depth <= 8);
bytes_per_pixel = (indexed ? 1 : 3);
- image_ID = create_new_image (filename, width, height,
- indexed ? GIMP_INDEXED : GIMP_RGB,
- &layer_ID, &drawable, &pixel_rgn);
-
- tile_height = gimp_tile_height ();
- data = g_malloc (tile_height * width * bytes_per_pixel);
-
for (j = 0; j < 256; j++) /* Create an array for reversing bits */
{
inmask = 0;
@@ -1913,6 +1922,16 @@ load_xwd_f1_d24_b1 (const gchar *filename,
maxblue = 0; while (bluemask >> (blueshift + maxblue)) maxblue++;
maxblue = (1 << maxblue) - 1;
+ if (maxred > sizeof (redmap) ||
+ maxgreen > sizeof (greenmap) ||
+ maxblue > sizeof (bluemap))
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("XWD-file %s is corrupt."),
+ gimp_filename_to_utf8 (filename));
+ return -1;
+ }
+
/* Set map-arrays for red, green, blue */
for (red = 0; red <= maxred; red++)
redmap[red] = (red * 255) / maxred;
@@ -1921,6 +1940,13 @@ load_xwd_f1_d24_b1 (const gchar *filename,
for (blue = 0; blue <= maxblue; blue++)
bluemap[blue] = (blue * 255) / maxblue;
}
+
+ image_ID = create_new_image (filename, width, height,
+ indexed ? GIMP_INDEXED : GIMP_RGB,
+ &layer_ID, &drawable, &pixel_rgn);
+
+ tile_height = gimp_tile_height ();
+ data = g_malloc (tile_height * width * bytes_per_pixel);
ncols = xwdhdr->l_colormap_entries;
if (xwdhdr->l_ncolors < ncols)