diff --git a/srcpkgs/gimp/patches/CVE-2016-4994.patch b/srcpkgs/gimp/patches/CVE-2016-4994.patch deleted file mode 100644 index a601e0b0125..00000000000 --- a/srcpkgs/gimp/patches/CVE-2016-4994.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 6d804bf9ae77bc86a0a97f9b944a129844df9395 Mon Sep 17 00:00:00 2001 -From: Shmuel H -Date: Mon, 20 Jun 2016 17:14:41 +0300 -Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing... - -...XCF channel and layer properties - -The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION, -PROP_ACTIVE_CHANNEL saves the current object pointer the @info -structure. Others like PROP_SELECTION (for channel) and -PROP_GROUP_ITEM (for layer) will delete the current object and create -a new object, leaving the pointers in @info invalid (dangling). - -Therefore, if a property from the first type will come before the -second, the result will be an UaF in the last lines of xcf_load_image -(when it actually using the pointers from @info). - -I wasn't able to exploit this bug because that -g_object_instance->c_class gets cleared by the last g_object_unref and -GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE. ---- - app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++ - 1 file changed, 29 insertions(+) - -diff --git app/xcf/xcf-load.c app/xcf/xcf-load.c -index f48558a..244d5c2 100644 ---- app/xcf/xcf-load.c -+++ app/xcf/xcf-load.c -@@ -1141,6 +1141,18 @@ xcf_load_layer_props (XcfInfo *info, - case PROP_GROUP_ITEM: - { - GimpLayer *group; -+ gboolean is_active_layer; -+ -+ /* We're going to delete *layer, Don't leave its pointers -+ * in @info. After that, we'll restore them back with the -+ * new pointer. See bug #767873. -+ */ -+ is_active_layer = (*layer == info->active_layer); -+ if (is_active_layer) -+ info->active_layer = NULL; -+ -+ if (*layer == info->floating_sel) -+ info->floating_sel = NULL; - - group = gimp_group_layer_new (image); - -@@ -1150,6 +1162,13 @@ xcf_load_layer_props (XcfInfo *info, - g_object_ref_sink (*layer); - g_object_unref (*layer); - *layer = group; -+ -+ if (is_active_layer) -+ info->active_layer = *layer; -+ -+ /* Don't restore info->floating_sel because group layers -+ * can't be floating selections -+ */ - } - break; - -@@ -1220,6 +1239,12 @@ xcf_load_channel_props (XcfInfo *info, - { - GimpChannel *mask; - -+ /* We're going to delete *channel, Don't leave its pointer -+ * in @info. See bug #767873. -+ */ -+ if (*channel == info->active_channel) -+ info->active_channel = NULL; -+ - mask = - gimp_selection_new (image, - gimp_item_get_width (GIMP_ITEM (*channel)), -@@ -1234,6 +1259,10 @@ xcf_load_channel_props (XcfInfo *info, - *channel = mask; - (*channel)->boundary_known = FALSE; - (*channel)->bounds_known = FALSE; -+ -+ /* Don't restore info->active_channel because the -+ * selection can't be the active channel -+ */ - } - break; - --- -cgit v0.12 - diff --git a/srcpkgs/gimp/template b/srcpkgs/gimp/template index 4c4e35b2578..1e2aa3810bf 100644 --- a/srcpkgs/gimp/template +++ b/srcpkgs/gimp/template @@ -1,7 +1,7 @@ # Template build file for 'gimp'. pkgname=gimp -version=2.8.16 -revision=2 +version=2.8.18 +revision=1 lib32disabled=yes build_style=gnu-configure configure_args="--without-aa --without-gvfs --enable-gimp-console @@ -26,7 +26,7 @@ maintainer="Juan RP " homepage="http://www.gimp.org" license="GPL-3" distfiles="http://download.gimp.org/pub/gimp/v${version%.*}/gimp-${version}.tar.bz2" -checksum=95e3857bd0b5162cf8d1eda8c78b741eef968c3e3ac6c1195aaac2a4e2574fb7 +checksum=39dd2247c678deaf5cc664397d3c6bd4fb910d3472290fd54b52b441b5815441 libgimp_package() { short_desc+=" - runtime libraries"