From 9d6ffca7f49dcbea1397b72d777a1dc01d8fe3b2d8dd95005e363b77ccc3bfcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ismail=20D=C3=B6nmez?= Date: Mon, 1 Aug 2016 08:13:51 +0000 Subject: [PATCH] Accepting request 416278 from home:mrdocs:branches:graphics update to 2.8.18, contains one CVE fix, some crash fixes and translation updates OBS-URL: https://build.opensuse.org/request/show/416278 OBS-URL: https://build.opensuse.org/package/show/graphics/gimp?expand=0&rev=5 --- gimp-2.8.16.tar.bz2 | 3 - gimp-2.8.18.tar.bz2 | 3 + gimp-Multiple-Use-After-Free.patch | 90 ------------------------------ gimp.changes | 45 +++++++++++++++ gimp.spec | 5 +- 5 files changed, 49 insertions(+), 97 deletions(-) delete mode 100644 gimp-2.8.16.tar.bz2 create mode 100644 gimp-2.8.18.tar.bz2 delete mode 100644 gimp-Multiple-Use-After-Free.patch diff --git a/gimp-2.8.16.tar.bz2 b/gimp-2.8.16.tar.bz2 deleted file mode 100644 index 9bb32a2..0000000 --- a/gimp-2.8.16.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:95e3857bd0b5162cf8d1eda8c78b741eef968c3e3ac6c1195aaac2a4e2574fb7 -size 20847212 diff --git a/gimp-2.8.18.tar.bz2 b/gimp-2.8.18.tar.bz2 new file mode 100644 index 0000000..17bfb97 --- /dev/null +++ b/gimp-2.8.18.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:39dd2247c678deaf5cc664397d3c6bd4fb910d3472290fd54b52b441b5815441 +size 20824198 diff --git a/gimp-Multiple-Use-After-Free.patch b/gimp-Multiple-Use-After-Free.patch deleted file mode 100644 index 60d3158..0000000 --- a/gimp-Multiple-Use-After-Free.patch +++ /dev/null @@ -1,90 +0,0 @@ -From e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f Mon Sep 17 00:00:00 2001 -From: Shmuel H -Date: Mon, 20 Jun 2016 17:14:41 +0300 -Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing... - -...XCF channel and layer properties - -The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION, -PROP_ACTIVE_CHANNEL saves the current object pointer the @info -structure. Others like PROP_SELECTION (for channel) and -PROP_GROUP_ITEM (for layer) will delete the current object and create -a new object, leaving the pointers in @info invalid (dangling). - -Therefore, if a property from the first type will come before the -second, the result will be an UaF in the last lines of xcf_load_image -(when it actually using the pointers from @info). - -I wasn't able to exploit this bug because that -g_object_instance->c_class gets cleared by the last g_object_unref and -GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE. - -(cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395) ---- - app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++ - 1 file changed, 29 insertions(+) - -diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c -index b180377..67cc6d4 100644 ---- a/app/xcf/xcf-load.c -+++ b/app/xcf/xcf-load.c -@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info, - case PROP_GROUP_ITEM: - { - GimpLayer *group; -+ gboolean is_active_layer; -+ -+ /* We're going to delete *layer, Don't leave its pointers -+ * in @info. After that, we'll restore them back with the -+ * new pointer. See bug #767873. -+ */ -+ is_active_layer = (*layer == info->active_layer); -+ if (is_active_layer) -+ info->active_layer = NULL; -+ -+ if (*layer == info->floating_sel) -+ info->floating_sel = NULL; - - group = gimp_group_layer_new (image); - -@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info, - g_object_ref_sink (*layer); - g_object_unref (*layer); - *layer = group; -+ -+ if (is_active_layer) -+ info->active_layer = *layer; -+ -+ /* Don't restore info->floating_sel because group layers -+ * can't be floating selections -+ */ - } - break; - -@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info, - { - GimpChannel *mask; - -+ /* We're going to delete *channel, Don't leave its pointer -+ * in @info. See bug #767873. -+ */ -+ if (*channel == info->active_channel) -+ info->active_channel = NULL; -+ - mask = - gimp_selection_new (image, - gimp_item_get_width (GIMP_ITEM (*channel)), -@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info, - *channel = mask; - (*channel)->boundary_known = FALSE; - (*channel)->bounds_known = FALSE; -+ -+ /* Don't restore info->active_channel because the -+ * selection can't be the active channel -+ */ - } - break; - --- -cgit v0.12 - diff --git a/gimp.changes b/gimp.changes index 86f2934..3fa2503 100644 --- a/gimp.changes +++ b/gimp.changes @@ -1,3 +1,48 @@ +------------------------------------------------------------------- +Sun Jul 31 04:04:52 UTC 2016 - plinnell@opensuse.org + +- update to 2.8.18 +- Drop gimp-Multiple-Use-After-Free.patch - upstreamed + +Core: + - Initialize fontconfig cache in separate thread to keep GUI + responsive on first startup + - Properly recognize layer masks as deactivated, e.g. for moving layers + - Create $XDG_DATA_HOME if it doesn't exist + - (CVE-2016-4994) Multiple Use-After-Free when parsing XCF channel + and layer properties + - Fix progress access to prevent crash on rapid sequence of commands + - Fix crash in gimp-gradient-segment-range-move + ++GUI: + + - Disable color picker buttons on OS X to prevent a GUI lockup + - Disable "new-style" full-screen mode on OS X to prevent a crash + - Pulsing progress bar in splash screen to indicate unknown durations + - Fix gamut warning color for lcms display filter + - Fix unbolding of bold font on edit + - Prevent accidental renaming of wrong adjacent item + ++Installer: + + - Change compression settings to decrease size by 20% + - Add Catalan, Danish, French, Dutch + ++Plug-ins: + + - Fix crash on sRGB JPEG image drag & drop + - Fix ambiguous octal-escaped output of c-source + - Fix KISS CEL export + - Fix progress bar for file-compressor + - Make Script-Fu regex match return proper character indexes for + Unicode characters + - Fix Script-Fu modulo for large numbers + ++General: + + - Documentation updates + - Bug fixes + - Translation updates + ------------------------------------------------------------------- Thu Jun 23 09:25:51 UTC 2016 - zaitor@opensuse.org diff --git a/gimp.spec b/gimp.spec index cdb677c..a12a3f0 100644 --- a/gimp.spec +++ b/gimp.spec @@ -20,7 +20,7 @@ %global apiver 2.0 Name: gimp -Version: 2.8.16 +Version: 2.8.18 Release: 0 Summary: The GNU Image Manipulation Program License: GPL-3.0+ @@ -31,8 +31,6 @@ Source1: macros.gimp # openSUSE palette file Source2: openSUSE.gpl Source99: baselibs.conf -# PATCH-FIX-UPSTREAM gimp-Multiple-Use-After-Free.patch boo#986021 bgo#767873 zaitor@opensuse.org -- Fix CVE-2016-4994 -Patch0: gimp-Multiple-Use-After-Free.patch BuildRequires: aalib-devel BuildRequires: alsa-devel >= 1.0.0 BuildRequires: babl-devel >= 0.1.10 @@ -227,7 +225,6 @@ This package contains the help browser for the GIMP. This package is optional. %lang_package %prep %setup -q -%patch0 -p1 translation-update-upstream translation-update-upstream po-libgimp gimp20-libgimp translation-update-upstream po-python gimp20-python