pool/gimp
SHA256
6
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Accepting request 416338 from graphics

Browse Source 
1

OBS-URL: https://build.opensuse.org/request/show/416338
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gimp?expand=0&rev=95
This commit is contained in:
Dominique Leuenberger 2016-08-05 16:13:04 +00:00 committed by Git OBS Bridge
commit add794174b
5 changed files with 49 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
gimp-2.8.16.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:95e3857bd0b5162cf8d1eda8c78b741eef968c3e3ac6c1195aaac2a4e2574fb7
size 20847212

3
gimp-2.8.18.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:39dd2247c678deaf5cc664397d3c6bd4fb910d3472290fd54b52b441b5815441
size 20824198

90
gimp-Multiple-Use-After-Free.patch
View File

@ -1,90 +0,0 @@
From e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f Mon Sep 17 00:00:00 2001
From: Shmuel H <shmuelgimp@gmail.com>
Date: Mon, 20 Jun 2016 17:14:41 +0300
Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
...XCF channel and layer properties
The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
PROP_ACTIVE_CHANNEL saves the current object pointer the @info
structure. Others like PROP_SELECTION (for channel) and
PROP_GROUP_ITEM (for layer) will delete the current object and create
a new object, leaving the pointers in @info invalid (dangling).
Therefore, if a property from the first type will come before the
second, the result will be an UaF in the last lines of xcf_load_image
(when it actually using the pointers from @info).
I wasn't able to exploit this bug because that
g_object_instance->c_class gets cleared by the last g_object_unref and
GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
(cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395)
---
app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
index b180377..67cc6d4 100644
--- a/app/xcf/xcf-load.c
+++ b/app/xcf/xcf-load.c
@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info,
case PROP_GROUP_ITEM:
{
GimpLayer *group;
+ gboolean is_active_layer;
+
+ /* We're going to delete *layer, Don't leave its pointers
+ * in @info. After that, we'll restore them back with the
+ * new pointer. See bug #767873.
+ */
+ is_active_layer = (*layer == info->active_layer);
+ if (is_active_layer)
+ info->active_layer = NULL;
+
+ if (*layer == info->floating_sel)
+ info->floating_sel = NULL;
group = gimp_group_layer_new (image);
@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info,
g_object_ref_sink (*layer);
g_object_unref (*layer);
*layer = group;
+
+ if (is_active_layer)
+ info->active_layer = *layer;
+
+ /* Don't restore info->floating_sel because group layers
+ * can't be floating selections
+ */
}
break;
@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info,
{
GimpChannel *mask;
+ /* We're going to delete *channel, Don't leave its pointer
+ * in @info. See bug #767873.
+ */
+ if (*channel == info->active_channel)
+ info->active_channel = NULL;
+
mask =
gimp_selection_new (image,
gimp_item_get_width (GIMP_ITEM (*channel)),
@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info,
*channel = mask;
(*channel)->boundary_known = FALSE;
(*channel)->bounds_known = FALSE;
+
+ /* Don't restore info->active_channel because the
+ * selection can't be the active channel
+ */
}
break;
--
cgit v0.12

45
gimp.changes
View File

@ -1,3 +1,48 @@
-------------------------------------------------------------------
Sun Jul 31 04:04:52 UTC 2016 - plinnell@opensuse.org
- update to 2.8.18
- Drop gimp-Multiple-Use-After-Free.patch - upstreamed
+Core:
- Initialize fontconfig cache in separate thread to keep GUI
responsive on first startup
- Properly recognize layer masks as deactivated, e.g. for moving layers
- Create $XDG_DATA_HOME if it doesn't exist
- (CVE-2016-4994) Multiple Use-After-Free when parsing XCF channel
and layer properties
- Fix progress access to prevent crash on rapid sequence of commands
- Fix crash in gimp-gradient-segment-range-move
+GUI:
- Disable color picker buttons on OS X to prevent a GUI lockup
- Disable "new-style" full-screen mode on OS X to prevent a crash
- Pulsing progress bar in splash screen to indicate unknown durations
- Fix gamut warning color for lcms display filter
- Fix unbolding of bold font on edit
- Prevent accidental renaming of wrong adjacent item
+Installer:
- Change compression settings to decrease size by 20%
- Add Catalan, Danish, French, Dutch
+Plug-ins:
- Fix crash on sRGB JPEG image drag & drop
- Fix ambiguous octal-escaped output of c-source
- Fix KISS CEL export
- Fix progress bar for file-compressor
- Make Script-Fu regex match return proper character indexes for
Unicode characters
- Fix Script-Fu modulo for large numbers
+General:
- Documentation updates
- Bug fixes
- Translation updates
-------------------------------------------------------------------
Thu Jun 23 09:25:51 UTC 2016 - zaitor@opensuse.org

5
gimp.spec
View File

@ -20,7 +20,7 @@
%global apiver 2.0
Name: gimp
Version: 2.8.16
Version: 2.8.18
Release: 0
Summary: The GNU Image Manipulation Program
License: GPL-3.0+
@ -31,8 +31,6 @@ Source1: macros.gimp
# openSUSE palette file
Source2: openSUSE.gpl
Source99: baselibs.conf
# PATCH-FIX-UPSTREAM gimp-Multiple-Use-After-Free.patch boo#986021 bgo#767873 zaitor@opensuse.org -- Fix CVE-2016-4994
Patch0: gimp-Multiple-Use-After-Free.patch
BuildRequires: aalib-devel
BuildRequires: alsa-devel >= 1.0.0
BuildRequires: babl-devel >= 0.1.10
@ -227,7 +225,6 @@ This package contains the help browser for the GIMP. This package is optional.
%lang_package
%prep
%setup -q
%patch0 -p1
translation-update-upstream
translation-update-upstream po-libgimp gimp20-libgimp
translation-update-upstream po-python gimp20-python