gimp: update to 2.8.18.

This commit is contained in:
Juan RP 2016-07-16 07:46:27 +02:00
parent 649a890619
commit 646d196244
2 changed files with 3 additions and 91 deletions

View File

@ -1,88 +0,0 @@
From 6d804bf9ae77bc86a0a97f9b944a129844df9395 Mon Sep 17 00:00:00 2001
From: Shmuel H <shmuelgimp@gmail.com>
Date: Mon, 20 Jun 2016 17:14:41 +0300
Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
...XCF channel and layer properties
The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
PROP_ACTIVE_CHANNEL saves the current object pointer the @info
structure. Others like PROP_SELECTION (for channel) and
PROP_GROUP_ITEM (for layer) will delete the current object and create
a new object, leaving the pointers in @info invalid (dangling).
Therefore, if a property from the first type will come before the
second, the result will be an UaF in the last lines of xcf_load_image
(when it actually using the pointers from @info).
I wasn't able to exploit this bug because that
g_object_instance->c_class gets cleared by the last g_object_unref and
GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
---
app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git app/xcf/xcf-load.c app/xcf/xcf-load.c
index f48558a..244d5c2 100644
--- app/xcf/xcf-load.c
+++ app/xcf/xcf-load.c
@@ -1141,6 +1141,18 @@ xcf_load_layer_props (XcfInfo *info,
case PROP_GROUP_ITEM:
{
GimpLayer *group;
+ gboolean is_active_layer;
+
+ /* We're going to delete *layer, Don't leave its pointers
+ * in @info. After that, we'll restore them back with the
+ * new pointer. See bug #767873.
+ */
+ is_active_layer = (*layer == info->active_layer);
+ if (is_active_layer)
+ info->active_layer = NULL;
+
+ if (*layer == info->floating_sel)
+ info->floating_sel = NULL;
group = gimp_group_layer_new (image);
@@ -1150,6 +1162,13 @@ xcf_load_layer_props (XcfInfo *info,
g_object_ref_sink (*layer);
g_object_unref (*layer);
*layer = group;
+
+ if (is_active_layer)
+ info->active_layer = *layer;
+
+ /* Don't restore info->floating_sel because group layers
+ * can't be floating selections
+ */
}
break;
@@ -1220,6 +1239,12 @@ xcf_load_channel_props (XcfInfo *info,
{
GimpChannel *mask;
+ /* We're going to delete *channel, Don't leave its pointer
+ * in @info. See bug #767873.
+ */
+ if (*channel == info->active_channel)
+ info->active_channel = NULL;
+
mask =
gimp_selection_new (image,
gimp_item_get_width (GIMP_ITEM (*channel)),
@@ -1234,6 +1259,10 @@ xcf_load_channel_props (XcfInfo *info,
*channel = mask;
(*channel)->boundary_known = FALSE;
(*channel)->bounds_known = FALSE;
+
+ /* Don't restore info->active_channel because the
+ * selection can't be the active channel
+ */
}
break;
--
cgit v0.12

View File

@ -1,7 +1,7 @@
# Template build file for 'gimp'.
pkgname=gimp
version=2.8.16
revision=2
version=2.8.18
revision=1
lib32disabled=yes
build_style=gnu-configure
configure_args="--without-aa --without-gvfs --enable-gimp-console
@ -26,7 +26,7 @@ maintainer="Juan RP <xtraeme@voidlinux.eu>"
homepage="http://www.gimp.org"
license="GPL-3"
distfiles="http://download.gimp.org/pub/gimp/v${version%.*}/gimp-${version}.tar.bz2"
checksum=95e3857bd0b5162cf8d1eda8c78b741eef968c3e3ac6c1195aaac2a4e2574fb7
checksum=39dd2247c678deaf5cc664397d3c6bd4fb910d3472290fd54b52b441b5815441
libgimp_package() {
short_desc+=" - runtime libraries"