From d042bb1325af3e27b3cf33d6321fd3cdc025cd4b Mon Sep 17 00:00:00 2001 From: Nils Philippsen Date: Sat, 16 Jul 2016 00:47:14 +0200 Subject: [PATCH] version 2.8.18 --- .gitignore | 1 + gimp-2.8.16-CVE-2016-4994.patch | 99 --------------------------------- gimp.spec | 15 ++--- sources | 2 +- 4 files changed, 7 insertions(+), 110 deletions(-) delete mode 100644 gimp-2.8.16-CVE-2016-4994.patch diff --git a/.gitignore b/.gitignore index a334b9d..dca07f8 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ gimp-2.6.10-1-autoreconf.patch.bz2 /gimp-2.8.12.tar.bz2 /gimp-2.8.14.tar.bz2 /gimp-2.8.16.tar.bz2 +/gimp-2.8.18.tar.bz2 diff --git a/gimp-2.8.16-CVE-2016-4994.patch b/gimp-2.8.16-CVE-2016-4994.patch deleted file mode 100644 index aa731ce..0000000 --- a/gimp-2.8.16-CVE-2016-4994.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 94e49c2beda08a9898775845d93bb3b1412305e8 Mon Sep 17 00:00:00 2001 -From: Nils Philippsen -Date: Thu, 30 Jun 2016 11:49:48 +0200 -Subject: [PATCH] patch: CVE-2016-4994 - -Squashed commit of the following: - -commit 9b9acd64de207608ffa47d01ce60a5bdf973148e -Author: Shmuel H -Date: Mon Jun 20 17:14:41 2016 +0300 - - Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing... - - ...XCF channel and layer properties - - The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION, - PROP_ACTIVE_CHANNEL saves the current object pointer the @info - structure. Others like PROP_SELECTION (for channel) and - PROP_GROUP_ITEM (for layer) will delete the current object and create - a new object, leaving the pointers in @info invalid (dangling). - - Therefore, if a property from the first type will come before the - second, the result will be an UaF in the last lines of xcf_load_image - (when it actually using the pointers from @info). - - I wasn't able to exploit this bug because that - g_object_instance->c_class gets cleared by the last g_object_unref and - GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE. - - (cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395) - (cherry picked from commit e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f) ---- - app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++ - 1 file changed, 29 insertions(+) - -diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c -index b180377..67cc6d4 100644 ---- a/app/xcf/xcf-load.c -+++ b/app/xcf/xcf-load.c -@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info, - case PROP_GROUP_ITEM: - { - GimpLayer *group; -+ gboolean is_active_layer; -+ -+ /* We're going to delete *layer, Don't leave its pointers -+ * in @info. After that, we'll restore them back with the -+ * new pointer. See bug #767873. -+ */ -+ is_active_layer = (*layer == info->active_layer); -+ if (is_active_layer) -+ info->active_layer = NULL; -+ -+ if (*layer == info->floating_sel) -+ info->floating_sel = NULL; - - group = gimp_group_layer_new (image); - -@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info, - g_object_ref_sink (*layer); - g_object_unref (*layer); - *layer = group; -+ -+ if (is_active_layer) -+ info->active_layer = *layer; -+ -+ /* Don't restore info->floating_sel because group layers -+ * can't be floating selections -+ */ - } - break; - -@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info, - { - GimpChannel *mask; - -+ /* We're going to delete *channel, Don't leave its pointer -+ * in @info. See bug #767873. -+ */ -+ if (*channel == info->active_channel) -+ info->active_channel = NULL; -+ - mask = - gimp_selection_new (image, - gimp_item_get_width (GIMP_ITEM (*channel)), -@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info, - *channel = mask; - (*channel)->boundary_known = FALSE; - (*channel)->bounds_known = FALSE; -+ -+ /* Don't restore info->active_channel because the -+ * selection can't be the active channel -+ */ - } - break; - --- -2.5.5 - diff --git a/gimp.spec b/gimp.spec index 467cd0f..9c22657 100644 --- a/gimp.spec +++ b/gimp.spec @@ -81,8 +81,8 @@ Summary: GNU Image Manipulation Program Name: gimp Epoch: 2 -Version: 2.8.16 -Release: %{?prerelprefix}2%{dotprerel}%{dotgitrev}%{?dist} +Version: 2.8.18 +Release: %{?prerelprefix}1%{dotprerel}%{dotgitrev}%{?dist} # Compute some version related macros. # Ugly, need to get quoting percent signs straight. @@ -202,13 +202,6 @@ Patch0: gimp-%{version}%{dashprerel}-git%{gitrev}.patch.bz2 # Fedora specific. Patch1: gimp-2.8.2-cm-system-monitor-profile-by-default.patch -# CVE-2016-4994: Fix multiple use-after-free when parsing XCF channel and layer -# properties -# Upstream commit: -# gimp-2-8: e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f -# master: 6d804bf9ae77bc86a0a97f9b944a129844df9395 -Patch2: gimp-2.8.16-CVE-2016-4994.patch - # use external help browser directly if help browser plug-in is not built Patch100: gimp-2.8.6-external-help-browser.patch @@ -298,7 +291,6 @@ EOF %endif %patch1 -p1 -b .cm-system-monitor-profile-by-default -%patch2 -p1 -b .CVE-2016-4994 %if ! %{with helpbrowser} %patch100 -p1 -b .external-help-browser @@ -660,6 +652,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || : %endif %changelog +* Sat Jul 16 2016 Nils Philippsen - 2:2.8.18-1 +- version 2.8.18 + * Thu Jun 30 2016 Nils Philippsen - 2:2.8.16-2 - fix multiple use-after-free bugs when parsing XCF channel and layer properties (#1348617) diff --git a/sources b/sources index 43a1a90..34e9d1e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -30e0a1b7c18b0e3415f4ac54567252ac gimp-2.8.16.tar.bz2 +5adaa11a68bc8a42bb2c778fee4d389c gimp-2.8.18.tar.bz2