rpms/gd
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check return value in gdImageBmpPtr to avoid double free (CVE-2018-1000222)

Browse Source 
Don't mark gdimagegrayscale/basic test as failing.
This commit is contained in:
Marek Skalický 2018-08-30 11:03:19 +02:00
parent 239e837e28
commit db74b09ab2
No known key found for this signature in database
GPG Key ID: ADCAA1DEE100A66D
2 changed files with 81 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
gd-2.2.5-gdImageBmpPtr-double-free.patch Normal file
View File

@ -0,0 +1,73 @@
From ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 Mon Sep 17 00:00:00 2001
From: Mike Frysinger <vapier@gentoo.org>
Date: Sat, 14 Jul 2018 13:54:08 -0400
Subject: [PATCH] bmp: check return value in gdImageBmpPtr
Closes #447.
---
src/gd_bmp.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/src/gd_bmp.c b/src/gd_bmp.c
index bde0b9d3..78f40d9a 100644
--- a/src/gd_bmp.c
+++ b/src/gd_bmp.c
@@ -47,6 +47,8 @@ static int bmp_read_4bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
static int bmp_read_8bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp_hdr_t *header);
static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info);
+static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression);
+
#define BMP_DEBUG(s)
static int gdBMPPutWord(gdIOCtx *out, int w)
@@ -87,8 +89,10 @@ BGD_DECLARE(void *) gdImageBmpPtr(gdImagePtr im, int *size, int compression)
void *rv;
gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
if (out == NULL) return NULL;
- gdImageBmpCtx(im, out, compression);
- rv = gdDPExtractData(out, size);
+ if (!_gdImageBmpCtx(im, out, compression))
+ rv = gdDPExtractData(out, size);
+ else
+ rv = NULL;
out->gd_free(out);
return rv;
}
@@ -141,6 +145,11 @@ BGD_DECLARE(void) gdImageBmp(gdImagePtr im, FILE *outFile, int compression)
compression - whether to apply RLE or not.
*/
BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
+{
+ _gdImageBmpCtx(im, out, compression);
+}
+
+static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
{
int bitmap_size = 0, info_size, total_size, padding;
int i, row, xpos, pixel;
@@ -148,6 +157,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
unsigned char *uncompressed_row = NULL, *uncompressed_row_start = NULL;
FILE *tmpfile_for_compression = NULL;
gdIOCtxPtr out_original = NULL;
+ int ret = 1;
/* No compression if its true colour or we don't support seek */
if (im->trueColor) {
@@ -325,6 +335,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
out_original = NULL;
}
+ ret = 0;
cleanup:
if (tmpfile_for_compression) {
#ifdef _WIN32
@@ -338,7 +349,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
if (out_original) {
out_original->gd_free(out_original);
}
- return;
+ return ret;
}
static int compress_row(unsigned char *row, int length)

16
gd.spec
View File

@ -9,7 +9,7 @@
Summary: A graphics library for quick creation of PNG or JPEG images
Name: gd
Version: 2.2.5
Release: 4%{?prever}%{?short}%{?dist}
Release: 5%{?prever}%{?short}%{?dist}
Group: System Environment/Libraries
License: MIT
URL: http://libgd.github.io/
@ -24,6 +24,8 @@ Source0: https://github.com/libgd/libgd/releases/download/gd-%{version}/li
Patch1: gd-2.1.0-multilib.patch
# CVE-2018-5711 - https://github.com/libgd/libgd/commit/a11f47475e6443b7f32d21f2271f28f417e2ac04
Patch2: gd-2.2.5-upstream.patch
# CVE-2018-1000222 - https://github.com/libgd/libgd/commit/ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5
Patch3: gd-2.2.5-gdImageBmpPtr-double-free.patch
BuildRequires: freetype-devel
BuildRequires: fontconfig-devel
@ -88,6 +90,7 @@ files for gd, a graphics library for creating PNG and JPEG graphics.
%setup -q -n libgd-%{version}%{?prever:-%{prever}}
%patch1 -p1 -b .mlib
%patch2 -p1 -b .upstream
%patch3 -p1 -b .gdImageBmpPtr-free
: $(perl config/getver.pl)
@ -132,13 +135,6 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libgd.a
%check
%ifarch %{ix86}
# See https://github.com/libgd/libgd/issues/359
XFAIL_TESTS="gdimagegrayscale/basic $XFAIL_TESTS"
%endif
export XFAIL_TESTS
: Upstream test suite
make check
@ -168,6 +164,10 @@ grep %{version} $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gdlib.pc
%changelog
* Thu Aug 30 2018 mskalick@redhat.com - 2.2.5-5
- Check return value in gdImageBmpPtr to avoid double free (CVE-2018-1000222)
- Don't mark gdimagegrayscale/basic test as failing
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild