[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
07/07: gnu: gegl: Fix CVE-2012-4433.
From: |
Efraim Flashner |
Subject: |
07/07: gnu: gegl: Fix CVE-2012-4433. |
Date: |
Mon, 30 May 2016 09:09:31 +0000 (UTC) |
efraim pushed a commit to branch master
in repository guix.
commit 5f1ba08953dfa44aee9efe4d38a50ffb3d949dc2
Author: Efraim Flashner <address@hidden>
Date: Mon May 30 12:01:32 2016 +0300
gnu: gegl: Fix CVE-2012-4433.
* gnu/packages/gimp.scm (gegl)[source]: Add patch.
* gnu/packages/patches/gegl-CVE-2012-4433.patch: New variable.
* gnu/local.mk (dist_patch_DATA): Add it.
---
gnu/local.mk | 1 +
gnu/packages/gimp.scm | 5 +-
gnu/packages/patches/gegl-CVE-2012-4433.patch | 117 +++++++++++++++++++++++++
3 files changed, 122 insertions(+), 1 deletion(-)
diff --git a/gnu/local.mk b/gnu/local.mk
index dc1b521..66538e6 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -501,6 +501,7 @@ dist_patch_DATA =
\
%D%/packages/patches/gcc-cross-environment-variables.patch \
%D%/packages/patches/gcc-libvtv-runpath.patch \
%D%/packages/patches/gcc-5.0-libvtv-runpath.patch \
+ %D%/packages/patches/gegl-CVE-2012-4433.patch \
%D%/packages/patches/geoclue-config.patch \
%D%/packages/patches/ghostscript-CVE-2015-3228.patch \
%D%/packages/patches/ghostscript-runpath.patch \
diff --git a/gnu/packages/gimp.scm b/gnu/packages/gimp.scm
index bd27943..b11791b 100644
--- a/gnu/packages/gimp.scm
+++ b/gnu/packages/gimp.scm
@@ -1,6 +1,7 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2014, 2015 Ludovic Courtès <address@hidden>
;;; Copyright © 2016 Ricardo Wurmus <address@hidden>
+;;; Copyright © 2016 Efraim Flashner <address@hidden>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -24,6 +25,7 @@
#:use-module ((guix licenses) #:prefix license:)
#:use-module (guix build-system gnu)
#:use-module (guix build-system glib-or-gtk)
+ #:use-module (gnu packages)
#:use-module (gnu packages algebra)
#:use-module (gnu packages pkg-config)
#:use-module (gnu packages glib)
@@ -75,7 +77,8 @@ provided as well as the framework to add new color models and
data types.")
"/" name "-" version ".tar.bz2")))
(sha256
(base32
- "09nlv06li9nrn74ifpm7223mxpg0s7cii702z72cpbwrjh6nlbnz"))))
+ "09nlv06li9nrn74ifpm7223mxpg0s7cii702z72cpbwrjh6nlbnz"))
+ (patches (search-patches "gegl-CVE-2012-4433.patch"))))
(build-system gnu-build-system)
(arguments
`(;; More than just the one test disabled below now fails; disable them
diff --git a/gnu/packages/patches/gegl-CVE-2012-4433.patch
b/gnu/packages/patches/gegl-CVE-2012-4433.patch
new file mode 100644
index 0000000..7352b78
--- /dev/null
+++ b/gnu/packages/patches/gegl-CVE-2012-4433.patch
@@ -0,0 +1,117 @@
+From: Michael Gilbert <address@hidden>
+Date: Mon, 9 Sep 2013 17:34:32 +0200
+Subject: Fix_CVE-2012-4433
+
+Multiple buffer overflow issues.
+
+Closes: #692435
+---
+ operations/external/ppm-load.c | 62 ++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 53 insertions(+), 9 deletions(-)
+
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index efe6d56..465096d 100644
+--- a/operations/external/ppm-load.c
++++ b/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file
to load."))
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+
+ typedef enum {
+ PIXMAP_ASCII = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+
+ typedef struct {
+ map_type type;
+- gint width;
+- gint height;
++ glong width;
++ glong height;
+ gsize numsamples; /* width * height * channels */
+ gsize bpc; /* bytes per channel */
+ guchar *data;
+@@ -82,12 +83,33 @@ ppm_load_read_header(FILE *fp,
+ }
+
+ /* Get Width and Height */
+- img->width = strtol (header,&ptr,0);
+- img->height = atoi (ptr);
+- img->numsamples = img->width * img->height * CHANNEL_COUNT;
++ errno = 0;
++ img->width = strtol (header,&ptr,10);
++ if (errno)
++ {
++ g_warning ("Error reading width: %s", strerror(errno));
++ return FALSE;
++ }
++ else if (img->width < 0)
++ {
++ g_warning ("Error: width is negative");
++ return FALSE;
++ }
++
++ img->height = strtol (ptr,&ptr,10);
++ if (errno)
++ {
++ g_warning ("Error reading height: %s", strerror(errno));
++ return FALSE;
++ }
++ else if (img->width < 0)
++ {
++ g_warning ("Error: height is negative");
++ return FALSE;
++ }
+
+ fgets (header,MAX_CHARS_IN_ROW,fp);
+- maxval = strtol (header,&ptr,0);
++ maxval = strtol (header,&ptr,10);
+
+ if ((maxval != 255) && (maxval != 65535))
+ {
+@@ -109,6 +131,16 @@ ppm_load_read_header(FILE *fp,
+ g_warning ("%s: Programmer stupidity error", G_STRLOC);
+ }
+
++ /* Later on, img->numsamples is multiplied with img->bpc to allocate
++ * memory. Ensure it doesn't overflow. */
++ if (!img->width || !img->height ||
++ G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
++ {
++ g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
++ return FALSE;
++ }
++ img->numsamples = img->width * img->height * CHANNEL_COUNT;
++
+ return TRUE;
+ }
+
+@@ -229,12 +261,24 @@ process (GeglOperation *operation,
+ if (!ppm_load_read_header (fp, &img))
+ goto out;
+
+- rect.height = img.height;
+- rect.width = img.width;
+-
+ /* Allocating Array Size */
++
++ /* Should use g_try_malloc(), but this causes crashes elsewhere because the
++ * error signalled by returning FALSE isn't properly acted upon. Therefore
++ * g_malloc() is used here which aborts if the requested memory size can't
be
++ * allocated causing a controlled crash. */
+ img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+
++ /* No-op without g_try_malloc(), see above. */
++ if (! img.data)
++ {
++ g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.",
((gsize)img.numsamples * img.bpc));
++ goto out;
++ }
++
++ rect.height = img.height;
++ rect.width = img.width;
++
+ switch (img.bpc)
+ {
+ case 1:
- branch master updated (538884c -> 5f1ba08), Efraim Flashner, 2016/05/30
- 01/07: gnu: tinyproxy: Update to 1.8.4 [Fixes CVE-2012-3505]., Efraim Flashner, 2016/05/30
- 02/07: gnu: dtach: Update to 0.9 [Fixes CVE-2012-3368]., Efraim Flashner, 2016/05/30
- 03/07: gnu: dtach: Use 'modify-phases'., Efraim Flashner, 2016/05/30
- 04/07: download: Update Sourceforge mirrors., Efraim Flashner, 2016/05/30
- 06/07: gnu: vte-0.28: Fix CVE-2012-2738., Efraim Flashner, 2016/05/30
- 05/07: gnu: t1lib: Fix CVE-2010-2642, CVE-2011-{0764, 1552, 1553, 1554}., Efraim Flashner, 2016/05/30
- 07/07: gnu: gegl: Fix CVE-2012-4433.,
Efraim Flashner <=