version 2.8.12
This commit is contained in:
parent
9d96f27386
commit
c367b20fd9
@ -1,177 +0,0 @@
|
|||||||
From e3a100aa5872a19c10aadcf27a569465970347fe Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nils Philippsen <nils@redhat.com>
|
|
||||||
Date: Wed, 4 Dec 2013 11:17:11 +0100
|
|
||||||
Subject: [PATCH] patch: CVE-2013-1913,1978
|
|
||||||
|
|
||||||
Squashed commit of the following:
|
|
||||||
|
|
||||||
commit 6a0912e7fe8b61e32c647d9ed3bc110b4a7f15cf
|
|
||||||
Author: Nils Philippsen <nils@redhat.com>
|
|
||||||
Date: Tue Nov 26 10:49:42 2013 +0100
|
|
||||||
|
|
||||||
file-xwd: sanity check # of colors and map entries (CVE-2013-1978)
|
|
||||||
|
|
||||||
The number of colors in an image shouldn't be higher than the number of
|
|
||||||
colormap entries. Additionally, consolidate post error cleanup in
|
|
||||||
load_image().
|
|
||||||
|
|
||||||
(cherry picked from commit 23f685931e5f000dd033a45c60c1e60d7f78caf4)
|
|
||||||
|
|
||||||
commit 0e95c2790d753d898f2d7ad560b48e5f487cf460
|
|
||||||
Author: Nils Philippsen <nils@redhat.com>
|
|
||||||
Date: Thu Nov 14 14:29:01 2013 +0100
|
|
||||||
|
|
||||||
file-xwd: sanity check colormap size (CVE-2013-1913)
|
|
||||||
|
|
||||||
(cherry picked from commit 32ae0f83e5748299641cceaabe3f80f1b3afd03e)
|
|
||||||
---
|
|
||||||
plug-ins/common/file-xwd.c | 62 +++++++++++++++++++++++++++-------------------
|
|
||||||
1 file changed, 37 insertions(+), 25 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c
|
|
||||||
index 3240f7e..ba07afd 100644
|
|
||||||
--- a/plug-ins/common/file-xwd.c
|
|
||||||
+++ b/plug-ins/common/file-xwd.c
|
|
||||||
@@ -424,9 +424,9 @@ static gint32
|
|
||||||
load_image (const gchar *filename,
|
|
||||||
GError **error)
|
|
||||||
{
|
|
||||||
- FILE *ifp;
|
|
||||||
+ FILE *ifp = NULL;
|
|
||||||
gint depth, bpp;
|
|
||||||
- gint32 image_ID;
|
|
||||||
+ gint32 image_ID = -1;
|
|
||||||
L_XWDFILEHEADER xwdhdr;
|
|
||||||
L_XWDCOLOR *xwdcolmap = NULL;
|
|
||||||
|
|
||||||
@@ -436,7 +436,7 @@ load_image (const gchar *filename,
|
|
||||||
g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),
|
|
||||||
_("Could not open '%s' for reading: %s"),
|
|
||||||
gimp_filename_to_utf8 (filename), g_strerror (errno));
|
|
||||||
- return -1;
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
read_xwd_header (ifp, &xwdhdr);
|
|
||||||
@@ -445,8 +445,7 @@ load_image (const gchar *filename,
|
|
||||||
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
||||||
_("Could not read XWD header from '%s'"),
|
|
||||||
gimp_filename_to_utf8 (filename));
|
|
||||||
- fclose (ifp);
|
|
||||||
- return -1;
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef XWD_COL_WAIT_DEBUG
|
|
||||||
@@ -461,8 +460,25 @@ load_image (const gchar *filename,
|
|
||||||
/* Position to start of XWDColor structures */
|
|
||||||
fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET);
|
|
||||||
|
|
||||||
+ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only
|
|
||||||
+ * accepts colormaps with 0..256 colors anyway. */
|
|
||||||
+ if (xwdhdr.l_colormap_entries > 256)
|
|
||||||
+ {
|
|
||||||
+ g_message (_("'%s':\nIllegal number of colormap entries: %ld"),
|
|
||||||
+ gimp_filename_to_utf8 (filename),
|
|
||||||
+ (long)xwdhdr.l_colormap_entries);
|
|
||||||
+ goto out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (xwdhdr.l_colormap_entries > 0)
|
|
||||||
{
|
|
||||||
+ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)
|
|
||||||
+ {
|
|
||||||
+ g_message (_("'%s':\nNumber of colormap entries < number of colors"),
|
|
||||||
+ gimp_filename_to_utf8 (filename));
|
|
||||||
+ goto out;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);
|
|
||||||
|
|
||||||
read_xwd_cols (ifp, &xwdhdr, xwdcolmap);
|
|
||||||
@@ -482,9 +498,7 @@ load_image (const gchar *filename,
|
|
||||||
if (xwdhdr.l_file_version != 7)
|
|
||||||
{
|
|
||||||
g_message (_("Can't read color entries"));
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
- fclose (ifp);
|
|
||||||
- return (-1);
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -492,9 +506,7 @@ load_image (const gchar *filename,
|
|
||||||
{
|
|
||||||
g_message (_("'%s':\nNo image width specified"),
|
|
||||||
gimp_filename_to_utf8 (filename));
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
- fclose (ifp);
|
|
||||||
- return (-1);
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE
|
|
||||||
@@ -502,27 +514,21 @@ load_image (const gchar *filename,
|
|
||||||
{
|
|
||||||
g_message (_("'%s':\nImage width is larger than GIMP can handle"),
|
|
||||||
gimp_filename_to_utf8 (filename));
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
- fclose (ifp);
|
|
||||||
- return (-1);
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (xwdhdr.l_pixmap_height <= 0)
|
|
||||||
{
|
|
||||||
g_message (_("'%s':\nNo image height specified"),
|
|
||||||
gimp_filename_to_utf8 (filename));
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
- fclose (ifp);
|
|
||||||
- return (-1);
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)
|
|
||||||
{
|
|
||||||
g_message (_("'%s':\nImage height is larger than GIMP can handle"),
|
|
||||||
gimp_filename_to_utf8 (filename));
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
- fclose (ifp);
|
|
||||||
- return (-1);
|
|
||||||
+ goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
gimp_progress_init_printf (_("Opening '%s'"),
|
|
||||||
@@ -571,11 +577,6 @@ load_image (const gchar *filename,
|
|
||||||
}
|
|
||||||
gimp_progress_update (1.0);
|
|
||||||
|
|
||||||
- fclose (ifp);
|
|
||||||
-
|
|
||||||
- if (xwdcolmap)
|
|
||||||
- g_free (xwdcolmap);
|
|
||||||
-
|
|
||||||
if (image_ID == -1 && ! (error && *error))
|
|
||||||
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
||||||
_("XWD-file %s has format %d, depth %d and bits per pixel %d. "
|
|
||||||
@@ -583,6 +584,17 @@ load_image (const gchar *filename,
|
|
||||||
gimp_filename_to_utf8 (filename),
|
|
||||||
(gint) xwdhdr.l_pixmap_format, depth, bpp);
|
|
||||||
|
|
||||||
+out:
|
|
||||||
+ if (ifp)
|
|
||||||
+ {
|
|
||||||
+ fclose (ifp);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (xwdcolmap)
|
|
||||||
+ {
|
|
||||||
+ g_free (xwdcolmap);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
return image_ID;
|
|
||||||
}
|
|
||||||
|
|
||||||
--
|
|
||||||
1.8.4.2
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
|||||||
From e7fdd16c6f5bde5ca53a5c1e429e2d6074d9b45b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nils Philippsen <nils@redhat.com>
|
|
||||||
Date: Thu, 13 Feb 2014 12:04:17 +0100
|
|
||||||
Subject: [PATCH] patch: freetype-include-madness
|
|
||||||
|
|
||||||
Squashed commit of the following:
|
|
||||||
|
|
||||||
commit 529499204591258106b359be24f03f734201b8ba
|
|
||||||
Author: Michael Natterer <mitch@gimp.org>
|
|
||||||
Date: Fri Nov 29 21:57:46 2013 +0100
|
|
||||||
|
|
||||||
Bug 719560 - Build failure with freetype 2.5.1
|
|
||||||
|
|
||||||
Apply patch from su-v that fixes the freetype include to
|
|
||||||
the madness devised and recommended by freetype.
|
|
||||||
|
|
||||||
(cherry picked from commit 6c73f28b6d87a2afd11974552a075bffec52347f)
|
|
||||||
---
|
|
||||||
app/text/gimpfont.c | 4 +++-
|
|
||||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/app/text/gimpfont.c b/app/text/gimpfont.c
|
|
||||||
index aa5f3ba..d052c6d 100644
|
|
||||||
--- a/app/text/gimpfont.c
|
|
||||||
+++ b/app/text/gimpfont.c
|
|
||||||
@@ -27,7 +27,9 @@
|
|
||||||
|
|
||||||
#define PANGO_ENABLE_ENGINE 1 /* Argh */
|
|
||||||
#include <pango/pango-ot.h>
|
|
||||||
-#include <freetype/tttables.h>
|
|
||||||
+
|
|
||||||
+#include <ft2build.h>
|
|
||||||
+#include FT_TRUETYPE_TABLES_H
|
|
||||||
|
|
||||||
#include "text-types.h"
|
|
||||||
|
|
||||||
--
|
|
||||||
1.8.5.3
|
|
||||||
|
|
19
gimp.spec
19
gimp.spec
@ -81,8 +81,8 @@
|
|||||||
Summary: GNU Image Manipulation Program
|
Summary: GNU Image Manipulation Program
|
||||||
Name: gimp
|
Name: gimp
|
||||||
Epoch: 2
|
Epoch: 2
|
||||||
Version: 2.8.10
|
Version: 2.8.12
|
||||||
Release: %{?prerelprefix}6%{dotprerel}%{dotgitrev}%{?dist}.2
|
Release: %{?prerelprefix}1%{dotprerel}%{dotgitrev}%{?dist}
|
||||||
|
|
||||||
# Compute some version related macros.
|
# Compute some version related macros.
|
||||||
# Ugly, need to get quoting percent signs straight.
|
# Ugly, need to get quoting percent signs straight.
|
||||||
@ -201,16 +201,6 @@ Patch0: gimp-%{version}%{dashprerel}-git%{gitrev}.patch.bz2
|
|||||||
# Fedora specific.
|
# Fedora specific.
|
||||||
Patch1: gimp-2.8.2-cm-system-monitor-profile-by-default.patch
|
Patch1: gimp-2.8.2-cm-system-monitor-profile-by-default.patch
|
||||||
|
|
||||||
# Avoid buffer overflows in the XWD loader
|
|
||||||
# CVE-2013-1913, CVE-2013-1978
|
|
||||||
# Upstream commit 7f2322e4ced8ba393abc5a0aa15a607f340f0db8
|
|
||||||
# Upstream commit 0ffb3b6753aad00512349bba31bf5113054c6a0e
|
|
||||||
Patch2: gimp-2.8.10-CVE-2013-1913,1978.patch
|
|
||||||
|
|
||||||
# Cope with freetype >= 2.5.1 include madness
|
|
||||||
# Upstream commit 71c144c972d5582522b6d13a4194169916186c7a
|
|
||||||
Patch3: gimp-2.8.10-freetype-include-madness.patch
|
|
||||||
|
|
||||||
# use external help browser directly if help browser plug-in is not built
|
# use external help browser directly if help browser plug-in is not built
|
||||||
Patch100: gimp-2.8.6-external-help-browser.patch
|
Patch100: gimp-2.8.6-external-help-browser.patch
|
||||||
|
|
||||||
@ -300,8 +290,6 @@ EOF
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%patch1 -p1 -b .cm-system-monitor-profile-by-default
|
%patch1 -p1 -b .cm-system-monitor-profile-by-default
|
||||||
%patch2 -p1 -b .CVE-2013-1913,1978
|
|
||||||
%patch3 -p1 -b .freetype-include-madness
|
|
||||||
|
|
||||||
%if ! %{with helpbrowser}
|
%if ! %{with helpbrowser}
|
||||||
%patch100 -p1 -b .external-help-browser
|
%patch100 -p1 -b .external-help-browser
|
||||||
@ -653,6 +641,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Aug 26 2014 Nils Philippsen <nils@redhat.com> - 2:2.8.12-1
|
||||||
|
- version 2.8.12
|
||||||
|
|
||||||
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:2.8.10-6.2
|
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:2.8.10-6.2
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user