On Fri, 28 Feb 2014 20:57:22 -0500 Ari Pollak <a...@debian.org> wrote: > Thanks, looks good to me.
Okay, then next is patch for CVE-2013-1913/CVE-2013-1978 I'll push it to git repo once, so if something wrong with it, please revert. -- Regards, Hideki Yamane henrich @ debian.or.jp/org http://wiki.debian.org/HidekiYamane
Description: fix CVE-2013-1913 and CVE-2013-1978 Fixes xwd security vulnerabilities CVE-2013-1913 and CVE-2013-1978 CVE-2013-1978 is based on CVE-2013-1913 patched one, so merge it. Origin: upstream, https://git.gnome.org/browse/gimp/commit/?id=32ae0f83e5748299641cceaabe3f80f1b3afd03e upstream, https://git.gnome.org/browse/gimp/commit/?id=23f685931e5f000dd033a45c60c1e60d7f78caf4 Bug-Debian: http://bugs.debian.org/731305 Last-Update: 2014-03-01 Index: gimp/plug-ins/common/file-xwd.c =================================================================== --- gimp.orig/plug-ins/common/file-xwd.c 2014-03-01 22:29:00.825683080 +0900 +++ gimp/plug-ins/common/file-xwd.c 2014-03-01 22:29:10.121693974 +0900 @@ -424,9 +424,9 @@ load_image (const gchar *filename, GError **error) { - FILE *ifp; + FILE *ifp = NULL; gint depth, bpp; - gint32 image_ID; + gint32 image_ID = -1; L_XWDFILEHEADER xwdhdr; L_XWDCOLOR *xwdcolmap = NULL; @@ -436,7 +436,7 @@ g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), _("Could not open '%s' for reading: %s"), gimp_filename_to_utf8 (filename), g_strerror (errno)); - return -1; + goto out; } read_xwd_header (ifp, &xwdhdr); @@ -445,8 +445,7 @@ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("Could not read XWD header from '%s'"), gimp_filename_to_utf8 (filename)); - fclose (ifp); - return -1; + goto out; } #ifdef XWD_COL_WAIT_DEBUG @@ -461,8 +460,25 @@ /* Position to start of XWDColor structures */ fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + /* Guard against insanely huge color maps -- gimp_image_set_colormap() only + * accepts colormaps with 0..256 colors anyway. */ + if (xwdhdr.l_colormap_entries > 256) + { + g_message (_("'%s':\nIllegal number of colormap entries: %ld"), + gimp_filename_to_utf8 (filename), + (long)xwdhdr.l_colormap_entries); + goto out; + } + if (xwdhdr.l_colormap_entries > 0) { + if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) + { + g_message (_("'%s':\nNumber of colormap entries < number of colors"), + gimp_filename_to_utf8 (filename)); + goto out; + } + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); read_xwd_cols (ifp, &xwdhdr, xwdcolmap); @@ -482,9 +498,7 @@ if (xwdhdr.l_file_version != 7) { g_message (_("Can't read color entries")); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } } @@ -492,9 +506,7 @@ { g_message (_("'%s':\nNo image width specified"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE @@ -502,27 +514,21 @@ { g_message (_("'%s':\nImage width is larger than GIMP can handle"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_height <= 0) { g_message (_("'%s':\nNo image height specified"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) { g_message (_("'%s':\nImage height is larger than GIMP can handle"), gimp_filename_to_utf8 (filename)); - g_free (xwdcolmap); - fclose (ifp); - return (-1); + goto out; } gimp_progress_init_printf (_("Opening '%s'"), @@ -571,11 +577,6 @@ } gimp_progress_update (1.0); - fclose (ifp); - - if (xwdcolmap) - g_free (xwdcolmap); - if (image_ID == -1 && ! (error && *error)) g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("XWD-file %s has format %d, depth %d and bits per pixel %d. " @@ -583,6 +584,17 @@ gimp_filename_to_utf8 (filename), (gint) xwdhdr.l_pixmap_format, depth, bpp); +out: + if (ifp) + { + fclose (ifp); + } + + if (xwdcolmap) + { + g_free (xwdcolmap); + } + return image_ID; }
