120 lines
4.1 KiB
Diff
120 lines
4.1 KiB
Diff
commit 57aedabfa3bc555e4d68ad916c757354d518b421
|
|
Author: Nils Philippsen <nils@redhat.com>
|
|
Date: Tue Nov 17 11:52:25 2009 +0100
|
|
|
|
patch: bmp-hardening
|
|
|
|
Squashed commit of the following:
|
|
|
|
commit d7ee36732bc37f4412c82f98473288fde2f6f151
|
|
Author: Nils Philippsen <nils@redhat.com>
|
|
Date: Mon Nov 16 18:16:38 2009 +0100
|
|
|
|
Ensure valid bit depths when reading BMP files.
|
|
(cherry picked from commit 16e6a37687bb4b9748c5a5d166d90f5d5bd2e9f3)
|
|
(cherry picked from commit 153ae579f7e7508d7a5b95bd569e91890f6b666e)
|
|
|
|
Signed-off-by: Nils Philippsen <nils@redhat.com>
|
|
|
|
commit b76b8400dfffd99826fe73dee81d76029b808689
|
|
Author: Nils Philippsen <nils@redhat.com>
|
|
Date: Mon Nov 16 17:16:09 2009 +0100
|
|
|
|
Use more defensive coding in plausibility check.
|
|
|
|
Use an equivalent division instead of multiplying values and checking if
|
|
they are more than G_MAXINT32, because divisions cannot overflow.
|
|
(cherry picked from commit f63ba36dd9cc01ca6da83fa05ddd12419ad8953e)
|
|
(cherry picked from commit 6e8ff603a2ee6a0940373723d1f075930dfd3ce0)
|
|
|
|
Signed-off-by: Nils Philippsen <nils@redhat.com>
|
|
|
|
commit c8bd5c99decca02158f9c0218b33fa057bfdf5ce
|
|
Author: Nils Philippsen <nils@redhat.com>
|
|
Date: Mon Nov 16 17:15:32 2009 +0100
|
|
|
|
Make plausibility check easier to understand.
|
|
|
|
Explicitly check that Bitmap_Head.biHeight is not G_MININT32
|
|
instead of relying on ABS(G_MININT32) being negative.
|
|
(cherry picked from commit 43d57c666346320436a0b668de5525387952784e)
|
|
(cherry picked from commit 0214e1ff271a5310731de81d00450a92d9bf0fcd)
|
|
|
|
Signed-off-by: Nils Philippsen <nils@redhat.com>
|
|
|
|
commit eec97e14def220b1de45dcece0a63eb9925f701f
|
|
Author: Simon Budig <simon@gimp.org>
|
|
Date: Tue Nov 10 00:08:59 2009 +0100
|
|
|
|
Harden the BMP plugin against integer overflows.
|
|
|
|
Issues discovered by Stefan Cornelius, Secunia Research, advisory SA37232
|
|
and CVE identifier CVE-2009-1570. Fixes bug #600484.
|
|
(cherry picked from commit df2b0aca2e7cdb95ebfd3454c65aaba0a83e9bbe)
|
|
|
|
Signed-off-by: Nils Philippsen <nils@redhat.com>
|
|
|
|
diff --git a/plug-ins/file-bmp/bmp-read.c b/plug-ins/file-bmp/bmp-read.c
|
|
index a1ebe47..7ac4cc4 100644
|
|
--- a/plug-ins/file-bmp/bmp-read.c
|
|
+++ b/plug-ins/file-bmp/bmp-read.c
|
|
@@ -400,9 +400,26 @@ ReadBMP (const gchar *name,
|
|
}
|
|
}
|
|
|
|
- /* Valid bitpdepthis 1, 4, 8, 16, 24, 32 */
|
|
+ /* Valid bit depth is 1, 4, 8, 16, 24, 32 */
|
|
/* 16 is awful, we should probably shoot whoever invented it */
|
|
|
|
+ switch (Bitmap_Head.biBitCnt)
|
|
+ {
|
|
+ case 1:
|
|
+ case 2:
|
|
+ case 4:
|
|
+ case 8:
|
|
+ case 16:
|
|
+ case 24:
|
|
+ case 32:
|
|
+ break;
|
|
+ default:
|
|
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
+ _("'%s' is not a valid BMP file"),
|
|
+ gimp_filename_to_utf8 (filename));
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
/* There should be some colors used! */
|
|
|
|
ColormapSize =
|
|
@@ -424,7 +441,10 @@ ReadBMP (const gchar *name,
|
|
return -1;
|
|
}
|
|
|
|
- if (Bitmap_Head.biWidth < 0)
|
|
+ /* biHeight may be negative, but G_MININT32 is dangerous because:
|
|
+ G_MININT32 == -(G_MININT32) */
|
|
+ if (Bitmap_Head.biWidth < 0 ||
|
|
+ Bitmap_Head.biHeight == G_MININT32)
|
|
{
|
|
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
_("'%s' is not a valid BMP file"),
|
|
@@ -448,6 +468,18 @@ ReadBMP (const gchar *name,
|
|
return -1;
|
|
}
|
|
|
|
+ /* protect against integer overflows caused by malicious BMPs */
|
|
+ /* use divisions in comparisons to avoid type overflows */
|
|
+
|
|
+ if (((guint64) Bitmap_Head.biWidth) > G_MAXINT32 / Bitmap_Head.biBitCnt ||
|
|
+ ((guint64) Bitmap_Head.biWidth) > (G_MAXINT32 / ABS (Bitmap_Head.biHeight)) / 4)
|
|
+ {
|
|
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
+ _("'%s' is not a valid BMP file"),
|
|
+ gimp_filename_to_utf8 (filename));
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
/* Windows and OS/2 declare filler so that rows are a multiple of
|
|
* word length (32 bits == 4 bytes)
|
|
*/
|