[packages/gegl] - rel 9 - fix for CVE-2012-4433 - fix building with latest UMFPACK - disable docs, fail to build
baggins
baggins at pld-linux.org
Sun Oct 12 20:32:36 CEST 2014
commit 996667501de310a44a06517444d4ee27c02c76ad
Author: Jan Rękorajski <baggins at pld-linux.org>
Date: Sun Oct 12 20:31:55 2014 +0200
- rel 9
- fix for CVE-2012-4433
- fix building with latest UMFPACK
- disable docs, fail to build
CVE-2012-4433.patch | 159 ++++++++++++++++++++++++++++++++++++++++++++++++++++
gegl.spec | 8 ++-
umfpack.patch | 13 +++++
3 files changed, 178 insertions(+), 2 deletions(-)
---
diff --git a/gegl.spec b/gegl.spec
index b18742b..61c7433 100644
--- a/gegl.spec
+++ b/gegl.spec
@@ -2,7 +2,7 @@
# Conditional build:
%bcond_with mmx # use MMX instructions
%bcond_with sse # use SSE instructions
-%bcond_without doc # apidocs
+%bcond_with doc # apidocs
# reenable when new babl will arrive that actually is able to build
%bcond_with introspection # API introspection
# reenable when new babl will arrive that actually is able to build
@@ -21,7 +21,7 @@ Summary: Generic image processing library
Summary(pl.UTF-8): Ogólna biblioteka przetwarzania obrazu
Name: gegl
Version: 0.2.0
-Release: 8
+Release: 9
License: LGPL v3+
Group: Libraries
Source0: http://ftp.gimp.org/pub/gegl/0.2/%{name}-%{version}.tar.bz2
@@ -31,6 +31,8 @@ Patch1: %{name}-ffmpeg.patch
Patch2: %{name}-ruby1.9.patch
Patch3: %{name}-build.patch
Patch4: %{name}-introspection.patch
+Patch5: umfpack.patch
+Patch6: CVE-2012-4433.patch
URL: http://www.gegl.org/
%{?with_introspection:BuildRequires: /usr/share/gir-1.0/Babl-0.1.gir}
BuildRequires: OpenEXR-devel
@@ -151,6 +153,8 @@ API języka Vala dla biblioteki gegl.
%patch2 -p1
%patch3 -p1
%patch4 -p1
+%patch5 -p1
+%patch6 -p1
%build
%{__libtoolize}
diff --git a/CVE-2012-4433.patch b/CVE-2012-4433.patch
new file mode 100644
index 0000000..965c6fc
--- /dev/null
+++ b/CVE-2012-4433.patch
@@ -0,0 +1,159 @@
+From ffa77a246652c7e706d690682fe659f50fbe5656 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils at redhat.com>
+Date: Mon, 1 Jul 2013 12:03:51 +0200
+Subject: [PATCH] patch: CVE-2012-4433
+
+Squashed commit of the following:
+
+commit 2a9071e2dc4cfe1aaa7a726805985281936f9874
+Author: Nils Philippsen <nils at redhat.com>
+Date: Tue Oct 16 16:57:37 2012 +0200
+
+ ppm-load: bring comment in line with reality
+
+ (cherry picked from commit 6975a9cfeaf0698b42ac81b1c2f00d13c8755453)
+
+commit 8bb88ebf78e54837322d3be74688f98800e9f33a
+Author: Nils Philippsen <nils at redhat.com>
+Date: Tue Oct 16 16:56:40 2012 +0200
+
+ ppm-load: CVE-2012-4433: add plausibility checks for header fields
+
+ Refuse values that are non-decimal, negative or overflow the target
+ type.
+
+ (cherry picked from commit 4757cdf73d3675478d645a3ec8250ba02168a230)
+
+commit 2b099886969bf055a8635d06a4d89f20fed1ee42
+Author: Nils Philippsen <nils at redhat.com>
+Date: Tue Oct 16 16:58:27 2012 +0200
+
+ ppm-load: CVE-2012-4433: don't overflow memory allocation
+
+ Carefully selected width/height values could cause the size of a later
+ allocation to overflow, resulting in a buffer much too small to store
+ the data which would then written beyond its end.
+
+ (cherry picked from commit 1e92e5235ded0415d555aa86066b8e4041ee5a53)
+---
+ operations/external/ppm-load.c | 64 +++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 54 insertions(+), 10 deletions(-)
+
+diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
+index efe6d56..e22521c 100644
+--- a/operations/external/ppm-load.c
++++ b/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+
+ typedef enum {
+ PIXMAP_ASCII = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+
+ typedef struct {
+ map_type type;
+- gint width;
+- gint height;
++ glong width;
++ glong height;
+ gsize numsamples; /* width * height * channels */
+ gsize bpc; /* bytes per channel */
+ guchar *data;
+@@ -61,7 +62,7 @@ ppm_load_read_header(FILE *fp,
+ gchar header[MAX_CHARS_IN_ROW];
+ gint maxval;
+
+- /* Check the PPM file Type P2 or P5 */
++ /* Check the PPM file Type P3 or P6 */
+ fgets (header,MAX_CHARS_IN_ROW,fp);
+
+ if (header[0] != ASCII_P ||
+@@ -82,12 +83,33 @@ ppm_load_read_header(FILE *fp,
+ }
+
+ /* Get Width and Height */
+- img->width = strtol (header,&ptr,0);
+- img->height = atoi (ptr);
+- img->numsamples = img->width * img->height * CHANNEL_COUNT;
++ errno = 0;
++ img->width = strtol (header,&ptr,10);
++ if (errno)
++ {
++ g_warning ("Error reading width: %s", strerror(errno));
++ return FALSE;
++ }
++ else if (img->width < 0)
++ {
++ g_warning ("Error: width is negative");
++ return FALSE;
++ }
++
++ img->height = strtol (ptr,&ptr,10);
++ if (errno)
++ {
++ g_warning ("Error reading height: %s", strerror(errno));
++ return FALSE;
++ }
++ else if (img->width < 0)
++ {
++ g_warning ("Error: height is negative");
++ return FALSE;
++ }
+
+ fgets (header,MAX_CHARS_IN_ROW,fp);
+- maxval = strtol (header,&ptr,0);
++ maxval = strtol (header,&ptr,10);
+
+ if ((maxval != 255) && (maxval != 65535))
+ {
+@@ -109,6 +131,16 @@ ppm_load_read_header(FILE *fp,
+ g_warning ("%s: Programmer stupidity error", G_STRLOC);
+ }
+
++ /* Later on, img->numsamples is multiplied with img->bpc to allocate
++ * memory. Ensure it doesn't overflow. */
++ if (!img->width || !img->height ||
++ G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
++ {
++ g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
++ return FALSE;
++ }
++ img->numsamples = img->width * img->height * CHANNEL_COUNT;
++
+ return TRUE;
+ }
+
+@@ -229,12 +261,24 @@ process (GeglOperation *operation,
+ if (!ppm_load_read_header (fp, &img))
+ goto out;
+
+- rect.height = img.height;
+- rect.width = img.width;
+-
+ /* Allocating Array Size */
++
++ /* Should use g_try_malloc(), but this causes crashes elsewhere because the
++ * error signalled by returning FALSE isn't properly acted upon. Therefore
++ * g_malloc() is used here which aborts if the requested memory size can't be
++ * allocated causing a controlled crash. */
+ img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+
++ /* No-op without g_try_malloc(), see above. */
++ if (! img.data)
++ {
++ g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
++ goto out;
++ }
++
++ rect.height = img.height;
++ rect.width = img.width;
++
+ switch (img.bpc)
+ {
+ case 1:
+--
+1.8.3.1
+
diff --git a/umfpack.patch b/umfpack.patch
new file mode 100644
index 0000000..d8d003b
--- /dev/null
+++ b/umfpack.patch
@@ -0,0 +1,13 @@
+--- gegl-0.2.0/operations/external/matting-levin.c~ 2012-03-29 22:05:50.000000000 +0200
++++ gegl-0.2.0/operations/external/matting-levin.c 2014-10-12 19:56:41.699138429 +0200
+@@ -61,6 +61,10 @@
+ #include <suitesparse/umfpack.h>
+ #endif
+
++#ifndef UF_long
++#define UF_long SuiteSparse_long
++#endif
++
+ #include "matting-levin-cblas.h"
+
+
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/gegl.git/commitdiff/996667501de310a44a06517444d4ee27c02c76ad
More information about the pld-cvs-commit
mailing list