From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id C6A321387E8 for ; Sat, 6 Sep 2014 21:13:50 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id BF12DE0894; Sat, 6 Sep 2014 21:13:49 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 43AA2E0894 for ; Sat, 6 Sep 2014 21:13:49 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 0CE6F33FEEE for ; Sat, 6 Sep 2014 21:13:48 +0000 (UTC) Received: by oystercatcher.gentoo.org (Postfix, from userid 2258) id 441B34E27; Sat, 6 Sep 2014 21:13:46 +0000 (UTC) From: "Sebastian Pipping (sping)" To: gentoo-commits@lists.gentoo.org Reply-To: gentoo-dev@lists.gentoo.org, sping@gentoo.org Subject: [gentoo-commits] gentoo-x86 commit in media-gfx/gimp/files: gimp-2.8.10-freetype251.patch gimp-2.8.10-CVE-2013-1913.patch gimp-2.8.10-CVE-2013-1978.patch X-VCS-Repository: gentoo-x86 X-VCS-Files: gimp-2.8.10-freetype251.patch gimp-2.8.10-CVE-2013-1913.patch gimp-2.8.10-CVE-2013-1978.patch X-VCS-Directories: media-gfx/gimp/files X-VCS-Committer: sping X-VCS-Committer-Name: Sebastian Pipping Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Message-Id: <20140906211346.441B34E27@oystercatcher.gentoo.org> Date: Sat, 6 Sep 2014 21:13:46 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 558d4464-7ccf-4341-9b20-78fbeb9f9d3c X-Archives-Hash: 03bfa8eecf6a209c41a8637488ccad85 sping 14/09/06 21:13:46 Added: gimp-2.8.10-freetype251.patch gimp-2.8.10-CVE-2013-1913.patch gimp-2.8.10-CVE-2013-1978.patch Log: media-gfx/gimp: 2.8.10-r2 CVE-2013-{1913,1978} (bug #493372) (Portage version: 2.2.12/cvs/Linux x86_64, signed Manifest commit with key 0x401A1600) Revision Changes Path 1.1 media-gfx/gimp/files/gimp-2.8.10-freetype251.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-freetype251.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-freetype251.patch?rev=1.1&content-type=text/plain Index: gimp-2.8.10-freetype251.patch =================================================================== >From 6c73f28b6d87a2afd11974552a075bffec52347f Mon Sep 17 00:00:00 2001 From: Michael Natterer Date: Fri, 29 Nov 2013 21:57:46 +0100 Subject: Bug 719560 - Build failure with freetype 2.5.1 Apply patch from su-v that fixes the freetype include to the madness devised and recommended by freetype. diff --git a/app/text/gimpfont.c b/app/text/gimpfont.c index 4045ca9..66c6e52 100644 --- a/app/text/gimpfont.c +++ b/app/text/gimpfont.c @@ -28,7 +28,9 @@ #define PANGO_ENABLE_ENGINE 1 /* Argh */ #include -#include + +#include +#include FT_TRUETYPE_TABLES_H #include "text-types.h" -- cgit v0.10.1 1.1 media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1913.patch?rev=1.1&content-type=text/plain Index: gimp-2.8.10-CVE-2013-1913.patch =================================================================== >From 32ae0f83e5748299641cceaabe3f80f1b3afd03e Mon Sep 17 00:00:00 2001 From: Nils Philippsen Date: Thu, 14 Nov 2013 14:29:01 +0100 Subject: file-xwd: sanity check colormap size (CVE-2013-1913) diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c index c8e1a6e..343129a 100644 --- a/plug-ins/common/file-xwd.c +++ b/plug-ins/common/file-xwd.c @@ -466,6 +466,17 @@ load_image (const gchar *filename, /* Position to start of XWDColor structures */ fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + /* Guard against insanely huge color maps -- gimp_image_set_colormap() only + * accepts colormaps with 0..256 colors anyway. */ + if (xwdhdr.l_colormap_entries > 256) + { + g_message (_("'%s':\nIllegal number of colormap entries: %ld"), + gimp_filename_to_utf8 (filename), + (long)xwdhdr.l_colormap_entries); + fclose (ifp); + return -1; + } + if (xwdhdr.l_colormap_entries > 0) { xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); -- cgit v0.10.1 1.1 media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/media-gfx/gimp/files/gimp-2.8.10-CVE-2013-1978.patch?rev=1.1&content-type=text/plain Index: gimp-2.8.10-CVE-2013-1978.patch =================================================================== >From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001 From: Nils Philippsen Date: Tue, 26 Nov 2013 10:49:42 +0100 Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978) The number of colors in an image shouldn't be higher than the number of colormap entries. Additionally, consolidate post error cleanup in load_image(). diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c index 343129a..4df9ce8 100644 --- a/plug-ins/common/file-xwd.c +++ b/plug-ins/common/file-xwd.c @@ -429,9 +429,9 @@ static gint32 load_image (const gchar *filename, GError **error) { - FILE *ifp; + FILE *ifp = NULL; gint depth, bpp; - gint32 image_ID; + gint32 image_ID = -1; L_XWDFILEHEADER xwdhdr; L_XWDCOLOR *xwdcolmap = NULL; @@ -441,7 +441,7 @@ load_image (const gchar *filename, g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), _("Could not open '%s' for reading: %s"), gimp_filename_to_utf8 (filename), g_strerror (errno)); - return -1; + goto out; } read_xwd_header (ifp, &xwdhdr); @@ -450,8 +450,7 @@ load_image (const gchar *filename, g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("Could not read XWD header from '%s'"), gimp_filename_to_utf8 (filename)); - fclose (ifp); - return -1; + goto out; } #ifdef XWD_COL_WAIT_DEBUG @@ -473,12 +472,18 @@ load_image (const gchar *filename, g_message (_("'%s':\nIllegal number of colormap entries: %ld"), gimp_filename_to_utf8 (filename), (long)xwdhdr.l_colormap_entries); - fclose (ifp); - return -1; + goto out; } if (xwdhdr.l_colormap_entries > 0) { + if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) + { + g_message (_("'%s':\nNumber of colormap entries < number of colors"), + gimp_filename_to_utf8 (filename)); + goto out; + } + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); read_xwd_cols (ifp, &xwdhdr, xwdcolmap); @@ -498,9 +503,7 @@ load_image (const gchar *filename, if (xwdhdr.l_file_version != 7) { g_message (_("Can't read color entries")); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } } @@ -508,9 +511,7 @@ load_image (const gchar *filename, { g_message (_("'%s':\nNo image width specified"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE @@ -518,27 +519,21 @@ load_image (const gchar *filename, { g_message (_("'%s':\nImage width is larger than GIMP can handle"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_height <= 0) { g_message (_("'%s':\nNo image height specified"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) { g_message (_("'%s':\nImage height is larger than GIMP can handle"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } gimp_progress_init_printf (_("Opening '%s'"), @@ -591,11 +586,6 @@ load_image (const gchar *filename, } gimp_progress_update (1.0); - fclose (ifp); - - if (xwdcolmap) - g_free (xwdcolmap); - if (image_ID == -1 && ! (error && *error)) g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("XWD-file %s has format %d, depth %d and bits per pixel %d. " @@ -603,6 +593,17 @@ load_image (const gchar *filename, gimp_filename_to_utf8 (filename), (gint) xwdhdr.l_pixmap_format, depth, bpp); +out: + if (ifp) + { + fclose (ifp); + } + + if (xwdcolmap) + { + g_free (xwdcolmap); + } + return image_ID; } -- cgit v0.10.1