gnu: gegl: Fix CVE-2012-4433.

* gnu/packages/gimp.scm (gegl)[source]: Add patch.
* gnu/packages/patches/gegl-CVE-2012-4433.patch: New variable.
* gnu/local.mk (dist_patch_DATA): Add it.
This commit is contained in:
Efraim Flashner 2016-05-30 12:01:32 +03:00
parent 7d48938a59
commit 5f1ba08953
No known key found for this signature in database
GPG Key ID: F4C1D3917EACEE93
3 changed files with 122 additions and 1 deletions

View File

@ -501,6 +501,7 @@ dist_patch_DATA = \
%D%/packages/patches/gcc-cross-environment-variables.patch \ %D%/packages/patches/gcc-cross-environment-variables.patch \
%D%/packages/patches/gcc-libvtv-runpath.patch \ %D%/packages/patches/gcc-libvtv-runpath.patch \
%D%/packages/patches/gcc-5.0-libvtv-runpath.patch \ %D%/packages/patches/gcc-5.0-libvtv-runpath.patch \
%D%/packages/patches/gegl-CVE-2012-4433.patch \
%D%/packages/patches/geoclue-config.patch \ %D%/packages/patches/geoclue-config.patch \
%D%/packages/patches/ghostscript-CVE-2015-3228.patch \ %D%/packages/patches/ghostscript-CVE-2015-3228.patch \
%D%/packages/patches/ghostscript-runpath.patch \ %D%/packages/patches/ghostscript-runpath.patch \

View File

@ -1,6 +1,7 @@
;;; GNU Guix --- Functional package management for GNU ;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org> ;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net> ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
;;; ;;;
;;; This file is part of GNU Guix. ;;; This file is part of GNU Guix.
;;; ;;;
@ -24,6 +25,7 @@
#:use-module ((guix licenses) #:prefix license:) #:use-module ((guix licenses) #:prefix license:)
#:use-module (guix build-system gnu) #:use-module (guix build-system gnu)
#:use-module (guix build-system glib-or-gtk) #:use-module (guix build-system glib-or-gtk)
#:use-module (gnu packages)
#:use-module (gnu packages algebra) #:use-module (gnu packages algebra)
#:use-module (gnu packages pkg-config) #:use-module (gnu packages pkg-config)
#:use-module (gnu packages glib) #:use-module (gnu packages glib)
@ -75,7 +77,8 @@ provided as well as the framework to add new color models and data types.")
"/" name "-" version ".tar.bz2"))) "/" name "-" version ".tar.bz2")))
(sha256 (sha256
(base32 (base32
"09nlv06li9nrn74ifpm7223mxpg0s7cii702z72cpbwrjh6nlbnz")))) "09nlv06li9nrn74ifpm7223mxpg0s7cii702z72cpbwrjh6nlbnz"))
(patches (search-patches "gegl-CVE-2012-4433.patch"))))
(build-system gnu-build-system) (build-system gnu-build-system)
(arguments (arguments
`(;; More than just the one test disabled below now fails; disable them `(;; More than just the one test disabled below now fails; disable them

View File

@ -0,0 +1,117 @@
From: Michael Gilbert <mgilbert@debian.org>
Date: Mon, 9 Sep 2013 17:34:32 +0200
Subject: Fix_CVE-2012-4433
Multiple buffer overflow issues.
Closes: #692435
---
operations/external/ppm-load.c | 62 ++++++++++++++++++++++++++++++++++++------
1 file changed, 53 insertions(+), 9 deletions(-)
diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
index efe6d56..465096d 100644
--- a/operations/external/ppm-load.c
+++ b/operations/external/ppm-load.c
@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
#include "gegl-chant.h"
#include <stdio.h>
#include <stdlib.h>
+#include <errno.h>
typedef enum {
PIXMAP_ASCII = 51,
@@ -44,8 +45,8 @@ typedef enum {
typedef struct {
map_type type;
- gint width;
- gint height;
+ glong width;
+ glong height;
gsize numsamples; /* width * height * channels */
gsize bpc; /* bytes per channel */
guchar *data;
@@ -82,12 +83,33 @@ ppm_load_read_header(FILE *fp,
}
/* Get Width and Height */
- img->width = strtol (header,&ptr,0);
- img->height = atoi (ptr);
- img->numsamples = img->width * img->height * CHANNEL_COUNT;
+ errno = 0;
+ img->width = strtol (header,&ptr,10);
+ if (errno)
+ {
+ g_warning ("Error reading width: %s", strerror(errno));
+ return FALSE;
+ }
+ else if (img->width < 0)
+ {
+ g_warning ("Error: width is negative");
+ return FALSE;
+ }
+
+ img->height = strtol (ptr,&ptr,10);
+ if (errno)
+ {
+ g_warning ("Error reading height: %s", strerror(errno));
+ return FALSE;
+ }
+ else if (img->width < 0)
+ {
+ g_warning ("Error: height is negative");
+ return FALSE;
+ }
fgets (header,MAX_CHARS_IN_ROW,fp);
- maxval = strtol (header,&ptr,0);
+ maxval = strtol (header,&ptr,10);
if ((maxval != 255) && (maxval != 65535))
{
@@ -109,6 +131,16 @@ ppm_load_read_header(FILE *fp,
g_warning ("%s: Programmer stupidity error", G_STRLOC);
}
+ /* Later on, img->numsamples is multiplied with img->bpc to allocate
+ * memory. Ensure it doesn't overflow. */
+ if (!img->width || !img->height ||
+ G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+ {
+ g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
+ return FALSE;
+ }
+ img->numsamples = img->width * img->height * CHANNEL_COUNT;
+
return TRUE;
}
@@ -229,12 +261,24 @@ process (GeglOperation *operation,
if (!ppm_load_read_header (fp, &img))
goto out;
- rect.height = img.height;
- rect.width = img.width;
-
/* Allocating Array Size */
+
+ /* Should use g_try_malloc(), but this causes crashes elsewhere because the
+ * error signalled by returning FALSE isn't properly acted upon. Therefore
+ * g_malloc() is used here which aborts if the requested memory size can't be
+ * allocated causing a controlled crash. */
img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+ /* No-op without g_try_malloc(), see above. */
+ if (! img.data)
+ {
+ g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
+ goto out;
+ }
+
+ rect.height = img.height;
+ rect.width = img.width;
+
switch (img.bpc)
{
case 1: