From da187cf94ff972567b990b3c113dd57278fc9e765fcaaa90d30e3d6777645b37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Lie?= <zaitor@opensuse.org>
Date: Thu, 23 Jun 2016 09:40:41 +0000
Subject: [PATCH] Accepting request 404200 from home:Zaitor:branches:graphics

Add patch to fix CVE-2016-4994

OBS-URL: https://build.opensuse.org/request/show/404200
OBS-URL: https://build.opensuse.org/package/show/graphics/gimp?expand=0&rev=4
---
 gimp-Multiple-Use-After-Free.patch | 90 ++++++++++++++++++++++++++++++
 gimp.changes                       |  7 +++
 gimp.spec                          |  3 +
 3 files changed, 100 insertions(+)
 create mode 100644 gimp-Multiple-Use-After-Free.patch

diff --git a/gimp-Multiple-Use-After-Free.patch b/gimp-Multiple-Use-After-Free.patch
new file mode 100644
index 0000000..60d3158
--- /dev/null
+++ b/gimp-Multiple-Use-After-Free.patch
@@ -0,0 +1,90 @@
+From e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f Mon Sep 17 00:00:00 2001
+From: Shmuel H <shmuelgimp@gmail.com>
+Date: Mon, 20 Jun 2016 17:14:41 +0300
+Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
+
+...XCF channel and layer properties
+
+The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
+PROP_ACTIVE_CHANNEL saves the current object pointer the @info
+structure. Others like PROP_SELECTION (for channel) and
+PROP_GROUP_ITEM (for layer) will delete the current object and create
+a new object, leaving the pointers in @info invalid (dangling).
+
+Therefore, if a property from the first type will come before the
+second, the result will be an UaF in the last lines of xcf_load_image
+(when it actually using the pointers from @info).
+
+I wasn't able to exploit this bug because that
+g_object_instance->c_class gets cleared by the last g_object_unref and
+GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
+
+(cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395)
+---
+ app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
+index b180377..67cc6d4 100644
+--- a/app/xcf/xcf-load.c
++++ b/app/xcf/xcf-load.c
+@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo    *info,
+         case PROP_GROUP_ITEM:
+           {
+             GimpLayer *group;
++            gboolean   is_active_layer;
++
++            /* We're going to delete *layer, Don't leave its pointers
++             * in @info.  After that, we'll restore them back with the
++             * new pointer. See bug #767873.
++             */
++            is_active_layer = (*layer == info->active_layer);
++            if (is_active_layer)
++              info->active_layer = NULL;
++
++            if (*layer == info->floating_sel)
++              info->floating_sel = NULL;
+ 
+             group = gimp_group_layer_new (image);
+ 
+@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo    *info,
+             g_object_ref_sink (*layer);
+             g_object_unref (*layer);
+             *layer = group;
++
++            if (is_active_layer)
++              info->active_layer = *layer;
++
++            /* Don't restore info->floating_sel because group layers
++             * can't be floating selections
++             */
+           }
+           break;
+ 
+@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo      *info,
+           {
+             GimpChannel *mask;
+ 
++            /* We're going to delete *channel, Don't leave its pointer
++             * in @info. See bug #767873.
++             */
++            if (*channel == info->active_channel)
++              info->active_channel = NULL;
++
+             mask =
+               gimp_selection_new (image,
+                                   gimp_item_get_width  (GIMP_ITEM (*channel)),
+@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo      *info,
+             *channel = mask;
+             (*channel)->boundary_known = FALSE;
+             (*channel)->bounds_known   = FALSE;
++
++            /* Don't restore info->active_channel because the
++             * selection can't be the active channel
++             */
+           }
+           break;
+ 
+-- 
+cgit v0.12
+
diff --git a/gimp.changes b/gimp.changes
index 0cf9354..86f2934 100644
--- a/gimp.changes
+++ b/gimp.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Thu Jun 23 09:25:51 UTC 2016 - zaitor@opensuse.org
+
+- Fix CVE-2016-4994 (boo#986021, bgo#767873):
+  + Add gimp-Multiple-Use-After-Free.patch: Multiple Use-After-Free
+    when parsing XCF channel and layer properties.
+
 -------------------------------------------------------------------
 Sat Dec  5 03:32:03 UTC 2015 - plinnell@opensuse.org
 
diff --git a/gimp.spec b/gimp.spec
index c97a198..cdb677c 100644
--- a/gimp.spec
+++ b/gimp.spec
@@ -31,6 +31,8 @@ Source1:        macros.gimp
 # openSUSE palette file
 Source2:        openSUSE.gpl
 Source99:       baselibs.conf
+# PATCH-FIX-UPSTREAM gimp-Multiple-Use-After-Free.patch boo#986021 bgo#767873 zaitor@opensuse.org -- Fix CVE-2016-4994
+Patch0:         gimp-Multiple-Use-After-Free.patch
 BuildRequires:  aalib-devel
 BuildRequires:  alsa-devel >= 1.0.0
 BuildRequires:  babl-devel >= 0.1.10
@@ -225,6 +227,7 @@ This package contains the help browser for the GIMP. This package is optional.
 %lang_package
 %prep
 %setup -q
+%patch0 -p1
 translation-update-upstream
 translation-update-upstream po-libgimp gimp20-libgimp
 translation-update-upstream po-python gimp20-python