From 5e32c045e91ed9b0609154f7be2c3366dde1a282 Mon Sep 17 00:00:00 2001

From: Nils Philippsen <nils@redhat.com>

Date: Fri, 29 Nov 2013 10:40:08 +0100

Subject: [PATCH] patch: CVE-2013-1913,1978

Squashed commit of the following:

commit 1f1e33f606e50f9efa338c92d036d837182dbfd5

Author: Nils Philippsen <nils@redhat.com>

Date:   Tue Nov 26 10:49:42 2013 +0100

    file-xwd: sanity check # of colors and map entries (CVE-2013-1978)

    The number of colors in an image shouldn't be higher than the number of

    colormap entries. Additionally, consolidate post error cleanup in

    load_image().

    (cherry picked from commit f597355beffd9e483e11407d4c3b56f32db3634d)

commit 005e17a83907d89b37a432b3edf458a7c82f78bf

Author: Nils Philippsen <nils@redhat.com>

Date:   Thu Nov 14 14:29:01 2013 +0100

    file-xwd: sanity check colormap size (CVE-2013-1913)

    (cherry picked from commit 3997c7188a71dc8fc4c6a7513061180cbbd3590e)

---

 plug-ins/common/file-xwd.c | 62 +++++++++++++++++++++++++++-------------------

 1 file changed, 37 insertions(+), 25 deletions(-)

diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c

index 3240f7e..ba07afd 100644

--- a/plug-ins/common/file-xwd.c

+++ b/plug-ins/common/file-xwd.c

@@ -424,9 +424,9 @@ static gint32

 load_image (const gchar  *filename,

             GError      **error)

 {

-  FILE            *ifp;

+  FILE            *ifp = NULL;

   gint             depth, bpp;

-  gint32           image_ID;

+  gint32           image_ID = -1;

   L_XWDFILEHEADER  xwdhdr;

   L_XWDCOLOR      *xwdcolmap = NULL;

@@ -436,7 +436,7 @@ load_image (const gchar  *filename,

       g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno),

                    _("Could not open '%s' for reading: %s"),

                    gimp_filename_to_utf8 (filename), g_strerror (errno));

-      return -1;

+      goto out;

     }

   read_xwd_header (ifp, &xwdhdr);

@@ -445,8 +445,7 @@ load_image (const gchar  *filename,

       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,

                    _("Could not read XWD header from '%s'"),

                    gimp_filename_to_utf8 (filename));

-      fclose (ifp);

-      return -1;

+      goto out;

     }

 #ifdef XWD_COL_WAIT_DEBUG

@@ -461,8 +460,25 @@ load_image (const gchar  *filename,

   /* Position to start of XWDColor structures */

   fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET);

+  /* Guard against insanely huge color maps -- gimp_image_set_colormap() only

+   * accepts colormaps with 0..256 colors anyway. */

+  if (xwdhdr.l_colormap_entries > 256)

+    {

+      g_message (_("'%s':\nIllegal number of colormap entries: %ld"),

+                 gimp_filename_to_utf8 (filename),

+                 (long)xwdhdr.l_colormap_entries);

+      goto out;

+    }

+

   if (xwdhdr.l_colormap_entries > 0)

     {

+      if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors)

+        {

+          g_message (_("'%s':\nNumber of colormap entries < number of colors"),

+                     gimp_filename_to_utf8 (filename));

+          goto out;

+        }

+

       xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries);

       read_xwd_cols (ifp, &xwdhdr, xwdcolmap);

@@ -482,9 +498,7 @@ load_image (const gchar  *filename,

       if (xwdhdr.l_file_version != 7)

         {

           g_message (_("Can't read color entries"));

-          g_free (xwdcolmap);

-          fclose (ifp);

-          return (-1);

+          goto out;

         }

     }

@@ -492,9 +506,7 @@ load_image (const gchar  *filename,

     {

       g_message (_("'%s':\nNo image width specified"),

                  gimp_filename_to_utf8 (filename));

-      g_free (xwdcolmap);

-      fclose (ifp);

-      return (-1);

+      goto out;

     }

   if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE

@@ -502,27 +514,21 @@ load_image (const gchar  *filename,

     {

       g_message (_("'%s':\nImage width is larger than GIMP can handle"),

                  gimp_filename_to_utf8 (filename));

-      g_free (xwdcolmap);

-      fclose (ifp);

-      return (-1);

+      goto out;

     }

   if (xwdhdr.l_pixmap_height <= 0)

     {

       g_message (_("'%s':\nNo image height specified"),

                  gimp_filename_to_utf8 (filename));

-      g_free (xwdcolmap);

-      fclose (ifp);

-      return (-1);

+      goto out;

     }

   if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE)

     {

       g_message (_("'%s':\nImage height is larger than GIMP can handle"),

                  gimp_filename_to_utf8 (filename));

-      g_free (xwdcolmap);

-      fclose (ifp);

-      return (-1);

+      goto out;

     }

   gimp_progress_init_printf (_("Opening '%s'"),

@@ -571,11 +577,6 @@ load_image (const gchar  *filename,

     }

   gimp_progress_update (1.0);

-  fclose (ifp);

-

-  if (xwdcolmap)

-    g_free (xwdcolmap);

-

   if (image_ID == -1 && ! (error && *error))

     g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,

                  _("XWD-file %s has format %d, depth %d and bits per pixel %d. "

@@ -583,6 +584,17 @@ load_image (const gchar  *filename,

                  gimp_filename_to_utf8 (filename),

                  (gint) xwdhdr.l_pixmap_format, depth, bpp);

+out:

+  if (ifp)

+    {

+      fclose (ifp);

+    }

+

+  if (xwdcolmap)

+    {

+      g_free (xwdcolmap);

+    }

+

   return image_ID;

 }

-- 

1.8.4.2