Attachment 829128 Details for Bug 953902 – proposed patch for CVE-2013-1978

[patch] proposed patch for CVE-2013-1978

0001-file-xwd-sanity-check-of-colors-and-map-entries-CVE-.patch (text/plain), 4.19 KB, created by Nils Philippsen on 2013-11-26 10:06:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nils Philippsen

Created: 2013-11-26 10:06:44 UTC

Size: 4.19 KB

patch

obsolete

>From 117200e1204c733913d0fe19c7f0da3a526d4f66 Mon Sep 17 00:00:00 2001
>From: Nils Philippsen <nils@redhat.com>
>Date: Tue, 26 Nov 2013 10:49:42 +0100
>Subject: [PATCH] file-xwd: sanity check # of colors and map entries
> (CVE-2013-1978)
>
>The number of colors in an image shouldn't be higher than the number of
>colormap entries. Additionally, consolidate post error cleanup in
>load_image().
>---
> plug-ins/common/file-xwd.c | 52 ++++++++++++++++++++++++----------------------
> 1 file changed, 27 insertions(+), 25 deletions(-)
>
>diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
>index 343129a..aa1d38c 100644
>--- a/plug-ins/common/file-xwd.c
>+++ b/plug-ins/common/file-xwd.c
>@@ -429,9 +429,9 @@ static gint32
> load_image (const gchar  *filename,
>             GError      **error)
> {
>-  FILE            *ifp;
>+  FILE            *ifp = NULL;
>   gint             depth, bpp;
>-  gint32           image_ID;
>+  gint32           image_ID = -1;
>   L_XWDFILEHEADER  xwdhdr;
>   L_XWDCOLOR      *xwdcolmap = NULL;
> 
>@@ -441,7 +441,7 @@ load_image (const gchar  *filename,
>       g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),
>                    _("Could not open '%s' for reading: %s"),
>                    gimp_filename_to_utf8 (filename), g_strerror (errno));
>-      return -1;
>+      goto out;
>     }
> 
>   read_xwd_header (ifp, &xwdhdr);
>@@ -450,8 +450,7 @@ load_image (const gchar  *filename,
>       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
>                    _("Could not read XWD header from '%s'"),
>                    gimp_filename_to_utf8 (filename));
>-      fclose (ifp);
>-      return -1;
>+      goto out;
>     }
> 
> #ifdef XWD_COL_WAIT_DEBUG
>@@ -479,6 +478,13 @@ load_image (const gchar  *filename,
> 
>   if (xwdhdr.l_colormap_entries > 0)
>     {
>+      if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)
>+        {
>+          g_message (_("'%s':\nNumber of colormap entries < number of colors"),
>+                     gimp_filename_to_utf8 (filename));
>+          goto out;
>+        }
>+
>       xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
> 
>       read_xwd_cols (ifp, &xwdhdr, xwdcolmap);
>@@ -498,9 +504,7 @@ load_image (const gchar  *filename,
>       if (xwdhdr.l_file_version != 7)
>         {
>           g_message (_("Can't read color entries"));
>-          g_free (xwdcolmap);
>-          fclose (ifp);
>-          return (-1);
>+          goto out;
>         }
>     }
> 
>@@ -508,9 +512,7 @@ load_image (const gchar  *filename,
>     {
>       g_message (_("'%s':\nNo image width specified"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE
>@@ -518,27 +520,21 @@ load_image (const gchar  *filename,
>     {
>       g_message (_("'%s':\nImage width is larger than GIMP can handle"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_height <= 0)
>     {
>       g_message (_("'%s':\nNo image height specified"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)
>     {
>       g_message (_("'%s':\nImage height is larger than GIMP can handle"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   gimp_progress_init_printf (_("Opening '%s'"),
>@@ -591,11 +587,6 @@ load_image (const gchar  *filename,
>     }
>   gimp_progress_update (1.0);
> 
>-  fclose (ifp);
>-
>-  if (xwdcolmap)
>-    g_free (xwdcolmap);
>-
>   if (image_ID == -1 && ! (error && *error))
>     g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
>                  _("XWD-file %s has format %d, depth %d and bits per pixel %d. "
>@@ -603,6 +594,17 @@ load_image (const gchar  *filename,
>                  gimp_filename_to_utf8 (filename),
>                  (gint) xwdhdr.l_pixmap_format, depth, bpp);
> 
>+out:
>+  if (ifp)
>+    {
>+      fclose (ifp);
>+    }
>+
>+  if (xwdcolmap)
>+    {
>+      g_free (xwdcolmap);
>+    }
>+
>   return image_ID;
> }
> 
>-- 
>1.8.4.2
>

Actions: View | Diff

Attachments on bug 953902: 829128 | 829635