Attachment 829635 Details for Bug 953902 – updated patch for CVE-2013-1978

[patch] updated patch for CVE-2013-1978

0002-file-xwd-sanity-check-of-colors-and-map-entries-CVE-.patch (text/plain), 4.43 KB, created by Nils Philippsen on 2013-11-27 10:41:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nils Philippsen

Created: 2013-11-27 10:41:39 UTC

Size: 4.43 KB

patch

obsolete

>From f597355beffd9e483e11407d4c3b56f32db3634d Mon Sep 17 00:00:00 2001
>From: Nils Philippsen <nils@redhat.com>
>Date: Tue, 26 Nov 2013 10:49:42 +0100
>Subject: [PATCH 2/2] file-xwd: sanity check # of colors and map entries
> (CVE-2013-1978)
>
>The number of colors in an image shouldn't be higher than the number of
>colormap entries. Additionally, consolidate post error cleanup in
>load_image().
>---
> plug-ins/common/file-xwd.c | 55 +++++++++++++++++++++++-----------------------
> 1 file changed, 28 insertions(+), 27 deletions(-)
>
>diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
>index 343129a..4df9ce8 100644
>--- a/plug-ins/common/file-xwd.c
>+++ b/plug-ins/common/file-xwd.c
>@@ -429,9 +429,9 @@ static gint32
> load_image (const gchar  *filename,
>             GError      **error)
> {
>-  FILE            *ifp;
>+  FILE            *ifp = NULL;
>   gint             depth, bpp;
>-  gint32           image_ID;
>+  gint32           image_ID = -1;
>   L_XWDFILEHEADER  xwdhdr;
>   L_XWDCOLOR      *xwdcolmap = NULL;
> 
>@@ -441,7 +441,7 @@ load_image (const gchar  *filename,
>       g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),
>                    _("Could not open '%s' for reading: %s"),
>                    gimp_filename_to_utf8 (filename), g_strerror (errno));
>-      return -1;
>+      goto out;
>     }
> 
>   read_xwd_header (ifp, &xwdhdr);
>@@ -450,8 +450,7 @@ load_image (const gchar  *filename,
>       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
>                    _("Could not read XWD header from '%s'"),
>                    gimp_filename_to_utf8 (filename));
>-      fclose (ifp);
>-      return -1;
>+      goto out;
>     }
> 
> #ifdef XWD_COL_WAIT_DEBUG
>@@ -473,12 +472,18 @@ load_image (const gchar  *filename,
>       g_message (_("'%s':\nIllegal number of colormap entries: %ld"),
>                  gimp_filename_to_utf8 (filename),
>                  (long)xwdhdr.l_colormap_entries);
>-      fclose (ifp);
>-      return -1;
>+      goto out;
>     }
> 
>   if (xwdhdr.l_colormap_entries > 0)
>     {
>+      if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)
>+        {
>+          g_message (_("'%s':\nNumber of colormap entries < number of colors"),
>+                     gimp_filename_to_utf8 (filename));
>+          goto out;
>+        }
>+
>       xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
> 
>       read_xwd_cols (ifp, &xwdhdr, xwdcolmap);
>@@ -498,9 +503,7 @@ load_image (const gchar  *filename,
>       if (xwdhdr.l_file_version != 7)
>         {
>           g_message (_("Can't read color entries"));
>-          g_free (xwdcolmap);
>-          fclose (ifp);
>-          return (-1);
>+          goto out;
>         }
>     }
> 
>@@ -508,9 +511,7 @@ load_image (const gchar  *filename,
>     {
>       g_message (_("'%s':\nNo image width specified"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE
>@@ -518,27 +519,21 @@ load_image (const gchar  *filename,
>     {
>       g_message (_("'%s':\nImage width is larger than GIMP can handle"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_height <= 0)
>     {
>       g_message (_("'%s':\nNo image height specified"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)
>     {
>       g_message (_("'%s':\nImage height is larger than GIMP can handle"),
>                  gimp_filename_to_utf8 (filename));
>-      g_free (xwdcolmap);
>-      fclose (ifp);
>-      return (-1);
>+      goto out;
>     }
> 
>   gimp_progress_init_printf (_("Opening '%s'"),
>@@ -591,11 +586,6 @@ load_image (const gchar  *filename,
>     }
>   gimp_progress_update (1.0);
> 
>-  fclose (ifp);
>-
>-  if (xwdcolmap)
>-    g_free (xwdcolmap);
>-
>   if (image_ID == -1 && ! (error && *error))
>     g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
>                  _("XWD-file %s has format %d, depth %d and bits per pixel %d. "
>@@ -603,6 +593,17 @@ load_image (const gchar  *filename,
>                  gimp_filename_to_utf8 (filename),
>                  (gint) xwdhdr.l_pixmap_format, depth, bpp);
> 
>+out:
>+  if (ifp)
>+    {
>+      fclose (ifp);
>+    }
>+
>+  if (xwdcolmap)
>+    {
>+      g_free (xwdcolmap);
>+    }
>+
>   return image_ID;
> }
> 
>-- 
>1.8.4.2
>

Actions: View | Diff

Attachments on bug 953902: 829128 | 829635