gegl02:add repo

2017-03-08 16:12:06 +03:00
parent 21dcafdf21
commit f0c9e54b68
6 changed files with 316 additions and 0 deletions
@@ -0,0 +1,68 @@
+From 1e92e5235ded0415d555aa86066b8e4041ee5a53 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Tue, 16 Oct 2012 14:58:27 +0000
+Subject: ppm-load: CVE-2012-4433: don't overflow memory allocation
+
+Carefully selected width/height values could cause the size of a later
+allocation to overflow, resulting in a buffer much too small to store
+the data which would then written beyond its end.
+---
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index efe6d56..3d6bce7 100644
+--- a/operations/external/ppm-load.c
+++ b/operations/external/ppm-load.c
+@@ -84,7 +84,6 @@ ppm_load_read_header(FILE       *fp,
+     /* Get Width and Height */
+     img->width  = strtol (header,&ptr,0);
+     img->height = atoi (ptr);
+-    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+ 
+     fgets (header,MAX_CHARS_IN_ROW,fp);
+     maxval = strtol (header,&ptr,0);
+@@ -109,6 +108,16 @@ ppm_load_read_header(FILE       *fp,
+       g_warning ("%s: Programmer stupidity error", G_STRLOC);
+     }
+ 
+    /* Later on, img->numsamples is multiplied with img->bpc to allocate
+     * memory. Ensure it doesn't overflow. */
+    if (!img->width || !img->height ||
+        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+      {
+        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
+        return FALSE;
+      }
+    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+
+     return TRUE;
+ }
+ 
+@@ -229,12 +238,24 @@ process (GeglOperation       *operation,
+   if (!ppm_load_read_header (fp, &img))
+     goto out;
+ 
+-  rect.height = img.height;
+-  rect.width = img.width;
+-
+   /* Allocating Array Size */
+
+  /* Should use g_try_malloc(), but this causes crashes elsewhere because the
+   * error signalled by returning FALSE isn't properly acted upon. Therefore
+   * g_malloc() is used here which aborts if the requested memory size can't be
+   * allocated causing a controlled crash. */
+   img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+ 
+  /* No-op without g_try_malloc(), see above. */
+  if (! img.data)
+    {
+      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
+      goto out;
+    }
+
+  rect.height = img.height;
+  rect.width = img.width;
+
+   switch (img.bpc)
+     {
+     case 1:
+--
+cgit v0.9.0.2
@@ -0,0 +1,70 @@
+From 4757cdf73d3675478d645a3ec8250ba02168a230 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Tue, 16 Oct 2012 14:56:40 +0000
+Subject: ppm-load: CVE-2012-4433: add plausibility checks for header fields
+
+Refuse values that are non-decimal, negative or overflow the target
+type.
+---
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index 3d6bce7..465096d 100644
+--- a/operations/external/ppm-load.c
+++ b/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
+#include <errno.h>
+ 
+ typedef enum {
+   PIXMAP_ASCII  = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+ 
+ typedef struct {
+ 	map_type   type;
+-	gint       width;
+-	gint       height;
+	glong      width;
+	glong      height;
+         gsize      numsamples; /* width * height * channels */
+         gsize      bpc;        /* bytes per channel */
+ 	guchar    *data;
+@@ -82,11 +83,33 @@ ppm_load_read_header(FILE       *fp,
+       }
+ 
+     /* Get Width and Height */
+-    img->width  = strtol (header,&ptr,0);
+-    img->height = atoi (ptr);
+    errno = 0;
+    img->width  = strtol (header,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading width: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: width is negative");
+        return FALSE;
+      }
+
+    img->height = strtol (ptr,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading height: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: height is negative");
+        return FALSE;
+      }
+ 
+     fgets (header,MAX_CHARS_IN_ROW,fp);
+-    maxval = strtol (header,&ptr,0);
+    maxval = strtol (header,&ptr,10);
+ 
+     if ((maxval != 255) && (maxval != 65535))
+       {
+--
+cgit v0.9.0.2
@@ -0,0 +1,11 @@
+--- operations/external/ff-load.c.orig	2012-04-01 13:17:57.000000000 +0200
+++ operations/external/ff-load.c	2012-07-11 12:42:05.174756560 +0200
+@@ -271,7 +271,7 @@
+       gint err;
+ 
+       ff_cleanup (o);
+-      err = av_open_input_file (&p->ic, o->path, NULL, 0, NULL);
+err = avformat_open_input (&p->ic, o->path, NULL, NULL);
+       if (err < 0)
+         {
+           print_error (o->path, err);