version 2.8.18
This commit is contained in:
Nils Philippsen
parent
bcc7a73609
commit
d042bb1325
1
.gitignore
vendored
1
.gitignore
vendored
@ -20,3 +20,4 @@ gimp-2.6.10-1-autoreconf.patch.bz2
|
||||
/gimp-2.8.12.tar.bz2
|
||||
/gimp-2.8.14.tar.bz2
|
||||
/gimp-2.8.16.tar.bz2
|
||||
/gimp-2.8.18.tar.bz2
|
||||
|
||||
@ -1,99 +0,0 @@
|
||||
From 94e49c2beda08a9898775845d93bb3b1412305e8 Mon Sep 17 00:00:00 2001
|
||||
From: Nils Philippsen <nils@redhat.com>
|
||||
Date: Thu, 30 Jun 2016 11:49:48 +0200
|
||||
Subject: [PATCH] patch: CVE-2016-4994
|
||||
|
||||
Squashed commit of the following:
|
||||
|
||||
commit 9b9acd64de207608ffa47d01ce60a5bdf973148e
|
||||
Author: Shmuel H <shmuelgimp@gmail.com>
|
||||
Date: Mon Jun 20 17:14:41 2016 +0300
|
||||
|
||||
Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
|
||||
|
||||
...XCF channel and layer properties
|
||||
|
||||
The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
|
||||
PROP_ACTIVE_CHANNEL saves the current object pointer the @info
|
||||
structure. Others like PROP_SELECTION (for channel) and
|
||||
PROP_GROUP_ITEM (for layer) will delete the current object and create
|
||||
a new object, leaving the pointers in @info invalid (dangling).
|
||||
|
||||
Therefore, if a property from the first type will come before the
|
||||
second, the result will be an UaF in the last lines of xcf_load_image
|
||||
(when it actually using the pointers from @info).
|
||||
|
||||
I wasn't able to exploit this bug because that
|
||||
g_object_instance->c_class gets cleared by the last g_object_unref and
|
||||
GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
|
||||
|
||||
(cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395)
|
||||
(cherry picked from commit e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f)
|
||||
---
|
||||
app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
|
||||
1 file changed, 29 insertions(+)
|
||||
|
||||
diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
|
||||
index b180377..67cc6d4 100644
|
||||
--- a/app/xcf/xcf-load.c
|
||||
+++ b/app/xcf/xcf-load.c
|
||||
@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info,
|
||||
case PROP_GROUP_ITEM:
|
||||
{
|
||||
GimpLayer *group;
|
||||
+ gboolean is_active_layer;
|
||||
+
|
||||
+ /* We're going to delete *layer, Don't leave its pointers
|
||||
+ * in @info. After that, we'll restore them back with the
|
||||
+ * new pointer. See bug #767873.
|
||||
+ */
|
||||
+ is_active_layer = (*layer == info->active_layer);
|
||||
+ if (is_active_layer)
|
||||
+ info->active_layer = NULL;
|
||||
+
|
||||
+ if (*layer == info->floating_sel)
|
||||
+ info->floating_sel = NULL;
|
||||
|
||||
group = gimp_group_layer_new (image);
|
||||
|
||||
@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info,
|
||||
g_object_ref_sink (*layer);
|
||||
g_object_unref (*layer);
|
||||
*layer = group;
|
||||
+
|
||||
+ if (is_active_layer)
|
||||
+ info->active_layer = *layer;
|
||||
+
|
||||
+ /* Don't restore info->floating_sel because group layers
|
||||
+ * can't be floating selections
|
||||
+ */
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info,
|
||||
{
|
||||
GimpChannel *mask;
|
||||
|
||||
+ /* We're going to delete *channel, Don't leave its pointer
|
||||
+ * in @info. See bug #767873.
|
||||
+ */
|
||||
+ if (*channel == info->active_channel)
|
||||
+ info->active_channel = NULL;
|
||||
+
|
||||
mask =
|
||||
gimp_selection_new (image,
|
||||
gimp_item_get_width (GIMP_ITEM (*channel)),
|
||||
@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info,
|
||||
*channel = mask;
|
||||
(*channel)->boundary_known = FALSE;
|
||||
(*channel)->bounds_known = FALSE;
|
||||
+
|
||||
+ /* Don't restore info->active_channel because the
|
||||
+ * selection can't be the active channel
|
||||
+ */
|
||||
}
|
||||
break;
|
||||
|
||||
--
|
||||
2.5.5
|
||||
|
||||
15
gimp.spec
15
gimp.spec
@ -81,8 +81,8 @@
|
||||
Summary: GNU Image Manipulation Program
|
||||
Name: gimp
|
||||
Epoch: 2
|
||||
Version: 2.8.16
|
||||
Release: %{?prerelprefix}2%{dotprerel}%{dotgitrev}%{?dist}
|
||||
Version: 2.8.18
|
||||
Release: %{?prerelprefix}1%{dotprerel}%{dotgitrev}%{?dist}
|
||||
|
||||
# Compute some version related macros.
|
||||
# Ugly, need to get quoting percent signs straight.
|
||||
@ -202,13 +202,6 @@ Patch0: gimp-%{version}%{dashprerel}-git%{gitrev}.patch.bz2
|
||||
# Fedora specific.
|
||||
Patch1: gimp-2.8.2-cm-system-monitor-profile-by-default.patch
|
||||
|
||||
# CVE-2016-4994: Fix multiple use-after-free when parsing XCF channel and layer
|
||||
# properties
|
||||
# Upstream commit:
|
||||
# gimp-2-8: e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
|
||||
# master: 6d804bf9ae77bc86a0a97f9b944a129844df9395
|
||||
Patch2: gimp-2.8.16-CVE-2016-4994.patch
|
||||
|
||||
# use external help browser directly if help browser plug-in is not built
|
||||
Patch100: gimp-2.8.6-external-help-browser.patch
|
||||
|
||||
@ -298,7 +291,6 @@ EOF
|
||||
%endif
|
||||
|
||||
%patch1 -p1 -b .cm-system-monitor-profile-by-default
|
||||
%patch2 -p1 -b .CVE-2016-4994
|
||||
|
||||
%if ! %{with helpbrowser}
|
||||
%patch100 -p1 -b .external-help-browser
|
||||
@ -660,6 +652,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Sat Jul 16 2016 Nils Philippsen <nils@redhat.com> - 2:2.8.18-1
|
||||
- version 2.8.18
|
||||
|
||||
* Thu Jun 30 2016 Nils Philippsen <nils@redhat.com> - 2:2.8.16-2
|
||||
- fix multiple use-after-free bugs when parsing XCF channel and layer
|
||||
properties (#1348617)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user