* [gentoo-commits] gentoo-x86 commit in media-gfx/gimp/files: gimp-2.8.10-freetype251.patch gimp-2.8.10-CVE-2013-1913.patch gimp-2.8.10-CVE-2013-1978.patch
@ 2014-09-06 21:13 Sebastian Pipping (sping)
0 siblings, 0 replies; only message in thread
From: Sebastian Pipping (sping) @ 2014-09-06 21:13 UTC (permalink / raw
To: gentoo-commits
sping 14/09/06 21:13:46
Added: gimp-2.8.10-freetype251.patch
gimp-2.8.10-CVE-2013-1913.patch
gimp-2.8.10-CVE-2013-1978.patch
Log:
media-gfx/gimp: 2.8.10-r2 CVE-2013-{1913,1978} (bug #493372)
(Portage version: 2.2.12/cvs/Linux x86_64, signed Manifest commit with key 0x401A1600)
Revision Changes Path
1.1 media-gfx/gimp/files/gimp-2.8.10-freetype251.patch
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-freetype251.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-freetype251.patch?rev=1.1&content-type=text/plain
Index: gimp-2.8.10-freetype251.patch
===================================================================
From 6c73f28b6d87a2afd11974552a075bffec52347f Mon Sep 17 00:00:00 2001
From: Michael Natterer <mitch@gimp.org>
Date: Fri, 29 Nov 2013 21:57:46 +0100
Subject: Bug 719560 - Build failure with freetype 2.5.1
Apply patch from su-v that fixes the freetype include to
the madness devised and recommended by freetype.
diff --git a/app/text/gimpfont.c b/app/text/gimpfont.c
index 4045ca9..66c6e52 100644
--- a/app/text/gimpfont.c
+++ b/app/text/gimpfont.c
@@ -28,7 +28,9 @@
#define PANGO_ENABLE_ENGINE 1 /* Argh */
#include <pango/pango-ot.h>
-#include <freetype/tttables.h>
+
+#include <ft2build.h>
+#include FT_TRUETYPE_TABLES_H
#include "text-types.h"
--
cgit v0.10.1
1.1 media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch?rev=1.1&content-type=text/plain
Index: gimp-2.8.10-CVE-2013-1913.patch
===================================================================
From 32ae0f83e5748299641cceaabe3f80f1b3afd03e Mon Sep 17 00:00:00 2001
From: Nils Philippsen <nils@redhat.com>
Date: Thu, 14 Nov 2013 14:29:01 +0100
Subject: file-xwd: sanity check colormap size (CVE-2013-1913)
diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
index c8e1a6e..343129a 100644
--- a/plug-ins/common/file-xwd.c
+++ b/plug-ins/common/file-xwd.c
@@ -466,6 +466,17 @@ load_image (const gchar *filename,
/* Position to start of XWDColor structures */
fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET);
+ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only
+ * accepts colormaps with 0..256 colors anyway. */
+ if (xwdhdr.l_colormap_entries > 256)
+ {
+ g_message (_("'%s':\nIllegal number of colormap entries: %ld"),
+ gimp_filename_to_utf8 (filename),
+ (long)xwdhdr.l_colormap_entries);
+ fclose (ifp);
+ return -1;
+ }
+
if (xwdhdr.l_colormap_entries > 0)
{
xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
--
cgit v0.10.1
1.1 media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch?rev=1.1&content-type=text/plain
Index: gimp-2.8.10-CVE-2013-1978.patch
===================================================================
From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001
From: Nils Philippsen <nils@redhat.com>
Date: Tue, 26 Nov 2013 10:49:42 +0100
Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978)
The number of colors in an image shouldn't be higher than the number of
colormap entries. Additionally, consolidate post error cleanup in
load_image().
diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
index 343129a..4df9ce8 100644
--- a/plug-ins/common/file-xwd.c
+++ b/plug-ins/common/file-xwd.c
@@ -429,9 +429,9 @@ static gint32
load_image (const gchar *filename,
GError **error)
{
- FILE *ifp;
+ FILE *ifp = NULL;
gint depth, bpp;
- gint32 image_ID;
+ gint32 image_ID = -1;
L_XWDFILEHEADER xwdhdr;
L_XWDCOLOR *xwdcolmap = NULL;
@@ -441,7 +441,7 @@ load_image (const gchar *filename,
g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),
_("Could not open '%s' for reading: %s"),
gimp_filename_to_utf8 (filename), g_strerror (errno));
- return -1;
+ goto out;
}
read_xwd_header (ifp, &xwdhdr);
@@ -450,8 +450,7 @@ load_image (const gchar *filename,
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("Could not read XWD header from '%s'"),
gimp_filename_to_utf8 (filename));
- fclose (ifp);
- return -1;
+ goto out;
}
#ifdef XWD_COL_WAIT_DEBUG
@@ -473,12 +472,18 @@ load_image (const gchar *filename,
g_message (_("'%s':\nIllegal number of colormap entries: %ld"),
gimp_filename_to_utf8 (filename),
(long)xwdhdr.l_colormap_entries);
- fclose (ifp);
- return -1;
+ goto out;
}
if (xwdhdr.l_colormap_entries > 0)
{
+ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)
+ {
+ g_message (_("'%s':\nNumber of colormap entries < number of colors"),
+ gimp_filename_to_utf8 (filename));
+ goto out;
+ }
+
xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
read_xwd_cols (ifp, &xwdhdr, xwdcolmap);
@@ -498,9 +503,7 @@ load_image (const gchar *filename,
if (xwdhdr.l_file_version != 7)
{
g_message (_("Can't read color entries"));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
}
@@ -508,9 +511,7 @@ load_image (const gchar *filename,
{
g_message (_("'%s':\nNo image width specified"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE
@@ -518,27 +519,21 @@ load_image (const gchar *filename,
{
g_message (_("'%s':\nImage width is larger than GIMP can handle"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_height <= 0)
{
g_message (_("'%s':\nNo image height specified"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)
{
g_message (_("'%s':\nImage height is larger than GIMP can handle"),
gimp_filename_to_utf8 (filename));
- g_free (xwdcolmap);
- fclose (ifp);
- return (-1);
+ goto out;
}
gimp_progress_init_printf (_("Opening '%s'"),
@@ -591,11 +586,6 @@ load_image (const gchar *filename,
}
gimp_progress_update (1.0);
- fclose (ifp);
-
- if (xwdcolmap)
- g_free (xwdcolmap);
-
if (image_ID == -1 && ! (error && *error))
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("XWD-file %s has format %d, depth %d and bits per pixel %d. "
@@ -603,6 +593,17 @@ load_image (const gchar *filename,
gimp_filename_to_utf8 (filename),
(gint) xwdhdr.l_pixmap_format, depth, bpp);
+out:
+ if (ifp)
+ {
+ fclose (ifp);
+ }
+
+ if (xwdcolmap)
+ {
+ g_free (xwdcolmap);
+ }
+
return image_ID;
}
--
cgit v0.10.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2014-09-06 21:13 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-06 21:13 [gentoo-commits] gentoo-x86 commit in media-gfx/gimp/files: gimp-2.8.10-freetype251.patch gimp-2.8.10-CVE-2013-1913.patch gimp-2.8.10-CVE-2013-1978.patch Sebastian Pipping (sping)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox