| From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001 |
| From: Nils Philippsen <nils@redhat.com> |
| Date: Tue, 26 Nov 2013 10:49:42 +0100 |
| Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978) |
| |
| The number of colors in an image shouldn't be higher than the number of |
| colormap entries. Additionally, consolidate post error cleanup in |
| load_image(). |
| |
| diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c |
| index 343129a..4df9ce8 100644 |
| --- a/plug-ins/common/file-xwd.c |
| +++ b/plug-ins/common/file-xwd.c |
| @@ -429,9 +429,9 @@ static gint32 |
| load_image (const gchar *filename, |
| GError **error) |
| { |
| - FILE *ifp; |
| + FILE *ifp = NULL; |
| gint depth, bpp; |
| - gint32 image_ID; |
| + gint32 image_ID = -1; |
| L_XWDFILEHEADER xwdhdr; |
| L_XWDCOLOR *xwdcolmap = NULL; |
| |
| @@ -441,7 +441,7 @@ load_image (const gchar *filename, |
| g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), |
| _("Could not open '%s' for reading: %s"), |
| gimp_filename_to_utf8 (filename), g_strerror (errno)); |
| - return -1; |
| + goto out; |
| } |
| |
| read_xwd_header (ifp, &xwdhdr); |
| @@ -450,8 +450,7 @@ load_image (const gchar *filename, |
| g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, |
| _("Could not read XWD header from '%s'"), |
| gimp_filename_to_utf8 (filename)); |
| - fclose (ifp); |
| - return -1; |
| + goto out; |
| } |
| |
| #ifdef XWD_COL_WAIT_DEBUG |
| @@ -473,12 +472,18 @@ load_image (const gchar *filename, |
| g_message (_("'%s':\nIllegal number of colormap entries: %ld"), |
| gimp_filename_to_utf8 (filename), |
| (long)xwdhdr.l_colormap_entries); |
| - fclose (ifp); |
| - return -1; |
| + goto out; |
| } |
| |
| if (xwdhdr.l_colormap_entries > 0) |
| { |
| + if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) |
| + { |
| + g_message (_("'%s':\nNumber of colormap entries < number of colors"), |
| + gimp_filename_to_utf8 (filename)); |
| + goto out; |
| + } |
| + |
| xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); |
| |
| read_xwd_cols (ifp, &xwdhdr, xwdcolmap); |
| @@ -498,9 +503,7 @@ load_image (const gchar *filename, |
| if (xwdhdr.l_file_version != 7) |
| { |
| g_message (_("Can't read color entries")); |
| - g_free (xwdcolmap); |
| - fclose (ifp); |
| - return (-1); |
| + goto out; |
| } |
| } |
| |
| @@ -508,9 +511,7 @@ load_image (const gchar *filename, |
| { |
| g_message (_("'%s':\nNo image width specified"), |
| gimp_filename_to_utf8 (filename)); |
| - g_free (xwdcolmap); |
| - fclose (ifp); |
| - return (-1); |
| + goto out; |
| } |
| |
| if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE |
| @@ -518,27 +519,21 @@ load_image (const gchar *filename, |
| { |
| g_message (_("'%s':\nImage width is larger than GIMP can handle"), |
| gimp_filename_to_utf8 (filename)); |
| - g_free (xwdcolmap); |
| - fclose (ifp); |
| - return (-1); |
| + goto out; |
| } |
| |
| if (xwdhdr.l_pixmap_height <= 0) |
| { |
| g_message (_("'%s':\nNo image height specified"), |
| gimp_filename_to_utf8 (filename)); |
| - g_free (xwdcolmap); |
| - fclose (ifp); |
| - return (-1); |
| + goto out; |
| } |
| |
| if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) |
| { |
| g_message (_("'%s':\nImage height is larger than GIMP can handle"), |
| gimp_filename_to_utf8 (filename)); |
| - g_free (xwdcolmap); |
| - fclose (ifp); |
| - return (-1); |
| + goto out; |
| } |
| |
| gimp_progress_init_printf (_("Opening '%s'"), |
| @@ -591,11 +586,6 @@ load_image (const gchar *filename, |
| } |
| gimp_progress_update (1.0); |
| |
| - fclose (ifp); |
| - |
| - if (xwdcolmap) |
| - g_free (xwdcolmap); |
| - |
| if (image_ID == -1 && ! (error && *error)) |
| g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, |
| _("XWD-file %s has format %d, depth %d and bits per pixel %d. " |
| @@ -603,6 +593,17 @@ load_image (const gchar *filename, |
| gimp_filename_to_utf8 (filename), |
| (gint) xwdhdr.l_pixmap_format, depth, bpp); |
| |
| +out: |
| + if (ifp) |
| + { |
| + fclose (ifp); |
| + } |
| + |
| + if (xwdcolmap) |
| + { |
| + g_free (xwdcolmap); |
| + } |
| + |
| return image_ID; |
| } |
| |
| -- |
| cgit v0.10.1 |
| |