From ffa77a246652c7e706d690682fe659f50fbe5656 Mon Sep 17 00:00:00 2001

From: Nils Philippsen <nils@redhat.com>

Date: Mon, 1 Jul 2013 12:03:51 +0200

Subject: [PATCH] patch: CVE-2012-4433

Squashed commit of the following:

commit 2a9071e2dc4cfe1aaa7a726805985281936f9874

Author: Nils Philippsen <nils@redhat.com>

Date:   Tue Oct 16 16:57:37 2012 +0200

    ppm-load: bring comment in line with reality

    (cherry picked from commit 6975a9cfeaf0698b42ac81b1c2f00d13c8755453)

commit 8bb88ebf78e54837322d3be74688f98800e9f33a

Author: Nils Philippsen <nils@redhat.com>

Date:   Tue Oct 16 16:56:40 2012 +0200

    ppm-load: CVE-2012-4433: add plausibility checks for header fields

    Refuse values that are non-decimal, negative or overflow the target

    type.

    (cherry picked from commit 4757cdf73d3675478d645a3ec8250ba02168a230)

commit 2b099886969bf055a8635d06a4d89f20fed1ee42

Author: Nils Philippsen <nils@redhat.com>

Date:   Tue Oct 16 16:58:27 2012 +0200

    ppm-load: CVE-2012-4433: don't overflow memory allocation

    Carefully selected width/height values could cause the size of a later

    allocation to overflow, resulting in a buffer much too small to store

    the data which would then written beyond its end.

    (cherry picked from commit 1e92e5235ded0415d555aa86066b8e4041ee5a53)

---

 operations/external/ppm-load.c | 64 +++++++++++++++++++++++++++++++++++-------

 1 file changed, 54 insertions(+), 10 deletions(-)

diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c

index efe6d56..e22521c 100644

--- a/operations/external/ppm-load.c

+++ b/operations/external/ppm-load.c

@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))

 #include "gegl-chant.h"

 #include <stdio.h>

 #include <stdlib.h>

+#include <errno.h>

 typedef enum {

   PIXMAP_ASCII  = 51,

@@ -44,8 +45,8 @@ typedef enum {

 typedef struct {

 	map_type   type;

-	gint       width;

-	gint       height;

+	glong      width;

+	glong      height;

         gsize      numsamples; /* width * height * channels */

         gsize      bpc;        /* bytes per channel */

 	guchar    *data;

@@ -61,7 +62,7 @@ ppm_load_read_header(FILE       *fp,

     gchar  header[MAX_CHARS_IN_ROW];

     gint   maxval;

-    /* Check the PPM file Type P2 or P5 */

+    /* Check the PPM file Type P3 or P6 */

     fgets (header,MAX_CHARS_IN_ROW,fp);

     if (header[0] != ASCII_P ||

@@ -82,12 +83,33 @@ ppm_load_read_header(FILE       *fp,

       }

     /* Get Width and Height */

-    img->width  = strtol (header,&ptr,0);

-    img->height = atoi (ptr);

-    img->numsamples = img->width * img->height * CHANNEL_COUNT;

+    errno = 0;

+    img->width  = strtol (header,&ptr,10);

+    if (errno)

+      {

+        g_warning ("Error reading width: %s", strerror(errno));

+        return FALSE;

+      }

+    else if (img->width < 0)

+      {

+        g_warning ("Error: width is negative");

+        return FALSE;

+      }

+

+    img->height = strtol (ptr,&ptr,10);

+    if (errno)

+      {

+        g_warning ("Error reading height: %s", strerror(errno));

+        return FALSE;

+      }

+    else if (img->width < 0)

+      {

+        g_warning ("Error: height is negative");

+        return FALSE;

+      }

     fgets (header,MAX_CHARS_IN_ROW,fp);

-    maxval = strtol (header,&ptr,0);

+    maxval = strtol (header,&ptr,10);

     if ((maxval != 255) && (maxval != 65535))

       {

@@ -109,6 +131,16 @@ ppm_load_read_header(FILE       *fp,

       g_warning ("%s: Programmer stupidity error", G_STRLOC);

     }

+    /* Later on, img->numsamples is multiplied with img->bpc to allocate

+     * memory. Ensure it doesn't overflow. */

+    if (!img->width || !img->height ||

+        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)

+      {

+        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);

+        return FALSE;

+      }

+    img->numsamples = img->width * img->height * CHANNEL_COUNT;

+

     return TRUE;

 }

@@ -229,12 +261,24 @@ process (GeglOperation       *operation,

   if (!ppm_load_read_header (fp, &img))

     goto out;

-  rect.height = img.height;

-  rect.width = img.width;

-

   /* Allocating Array Size */

+

+  /* Should use g_try_malloc(), but this causes crashes elsewhere because the

+   * error signalled by returning FALSE isn't properly acted upon. Therefore

+   * g_malloc() is used here which aborts if the requested memory size can't be

+   * allocated causing a controlled crash. */

   img.data = (guchar*) g_malloc (img.numsamples * img.bpc);

+  /* No-op without g_try_malloc(), see above. */

+  if (! img.data)

+    {

+      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));

+      goto out;

+    }

+

+  rect.height = img.height;

+  rect.width = img.width;

+

   switch (img.bpc)

     {

     case 1:

-- 

1.8.3.1