Source Mage code commit list

[Vlad Glagolev <scm AT sourcemage.org>]

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

 gnome2-libs/gdk-pixbuf2/DETAILS                 |    3 
 gnome2-libs/gdk-pixbuf2/HISTORY                 |    6 
 gnome2-libs/gdk-pixbuf2/PRE_BUILD               |    5 
 gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch     |  178 
++++++++++++++++++++++++
 gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch |   85 +++++++++++
 security/wireshark/DETAILS                      |   14 +
 security/wireshark/HISTORY                      |    3 
 7 files changed, 287 insertions(+), 7 deletions(-)

New commits:
commit 7689f91b88b50a2cc9b161be117ba2d2803bb9a6
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    gdk-pixbuf2: security update

commit 8fddfa93b301934a23d969d21c119824baa62e00
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    wireshark: => 1.12.8 [security]
    
    (cherry picked from commit 18a1ab8c2ed4b0cc73fe203edea4f41c4b29be03)
    
     Conflicts:
        security/wireshark/DETAILS

diff --git a/gnome2-libs/gdk-pixbuf2/DETAILS b/gnome2-libs/gdk-pixbuf2/DETAILS
index 27b0913..3a0de85 100755
--- a/gnome2-libs/gdk-pixbuf2/DETAILS
+++ b/gnome2-libs/gdk-pixbuf2/DETAILS
@@ -1,8 +1,7 @@
            SPELL=gdk-pixbuf2
          VERSION=2.30.8
      
SOURCE_HASH=sha512:2888cf035b70330e8d3ac87af54b69b2c990440fd59922464088d2a685e90022ad39c83d1ce1ccccfac3872b55ce9445ec4a3e9c7ab6371e20b19e20df7f261d
-  SECURITY_PATCH=1
-      PATCHLEVEL=0
+  SECURITY_PATCH=2
           BRANCH=`echo $VERSION|cut -d . -f 1,2`
           SOURCE=gdk-pixbuf-$VERSION.tar.xz
 SOURCE_DIRECTORY=$BUILD_DIRECTORY/gdk-pixbuf-$VERSION
diff --git a/gnome2-libs/gdk-pixbuf2/HISTORY b/gnome2-libs/gdk-pixbuf2/HISTORY
index 0db7cdc..d577e7d 100644
--- a/gnome2-libs/gdk-pixbuf2/HISTORY
+++ b/gnome2-libs/gdk-pixbuf2/HISTORY
@@ -1,3 +1,9 @@
+2015-12-24 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: SECURITY_PATCH++
+       * PRE_BUILD: added, to apply patch
+       * cve-2015-4491{,_pre}.patch: added, official patches to fix 
heap-based
+         buffer overflow and application crash (CVE-2015-4491)
+
 2015-05-10 Vlad Glagolev <stealth AT sourcemage.org>
        * DEPENDS: LZMA -> xz-utils
 
diff --git a/gnome2-libs/gdk-pixbuf2/PRE_BUILD 
b/gnome2-libs/gdk-pixbuf2/PRE_BUILD
new file mode 100755
index 0000000..ddd2108
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/PRE_BUILD
@@ -0,0 +1,5 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/cve-2015-4491_pre.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/cve-2015-4491.patch"
diff --git a/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch 
b/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch
new file mode 100644
index 0000000..0bbba94
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch
@@ -0,0 +1,178 @@
+From 8dba67cb4f38d62a47757741ad41e3f245b4a32a Mon Sep 17 00:00:00 2001
+From: Benjamin Otte <otte AT redhat.com>
+Date: Mon, 17 Aug 2015 18:52:47 +0200
+Subject: pixops: Fix oversight for CVE-2015-4491
+
+The n_x variable could be made large enough to overflow, too.
+
+Also included are various testcases for this vulnerability:
+- The original exploit (adapted for the testsuite)
+- Causing overflow by making both X and Y variables large
+- Causing overflow using only the X variable
+- Causing overflow using only the Y variable
+
+https://bugzilla.gnome.org/show_bug.cgi?id=752297
+---
+ gdk-pixbuf/pixops/pixops.c    |   6 ++-
+ tests/Makefile.am             |   7 ++++
+ tests/cve-2015-4491.bmp       | Bin 0 -> 82 bytes
+ tests/cve-2015-4491.c         |  87 
++++++++++++++++++++++++++++++++++++++++++
+ tests/resources.gresource.xml |   1 +
+ 5 files changed, 100 insertions(+), 1 deletion(-)
+ create mode 100644 tests/cve-2015-4491.bmp
+ create mode 100644 tests/cve-2015-4491.c
+
+diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
+index ce51745..7f2cbff 100644
+--- a/gdk-pixbuf/pixops/pixops.c
++++ b/gdk-pixbuf/pixops/pixops.c
+@@ -1275,7 +1275,11 @@ make_filter_table (PixopsFilter *filter)
+   gsize n_weights;
+   int *weights;
+ 
+-  n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
++  n_weights = SUBSAMPLE * SUBSAMPLE * n_x;
++  if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x)
++    return NULL; /* overflow, bail */
++
++  n_weights *= n_y;
+   if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
+     return NULL; /* overflow, bail */
+ 
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 058ad68..42db6e2 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -24,6 +24,7 @@ noinst_PROGRAMS +=                   \
+ 
+ test_programs =                       \
+       animation                       \
++      cve-2015-4491                   \
+       pixbuf-icon-serialize           \
+       pixbuf-randomly-modified        \
+       pixbuf-threads                  \
+@@ -54,6 +55,12 @@ dist_installed_test_data =          \
+       bug725582-testrotate.png        \
+       $(wildcard $(srcdir)/test-images/*)
+ 
++cve_2015_4491_SOURCES =                       \
++      cve-2015-4491.c                 \
++      resources.h                     \
++      resources.c                     \
++      $(NULL)
++
+ pixbuf_icc_SOURCES =                  \
+       pixbuf-icc.c                    \
+       test-common.c                   \
+diff --git a/tests/cve-2015-4491.bmp b/tests/cve-2015-4491.bmp
+new file mode 100644
+index 0000000..5d3c105
+Binary files /dev/null and b/tests/cve-2015-4491.bmp differ
+diff --git a/tests/cve-2015-4491.c b/tests/cve-2015-4491.c
+new file mode 100644
+index 0000000..34ba94f
+--- /dev/null
++++ b/tests/cve-2015-4491.c
+@@ -0,0 +1,87 @@
++/* GdkPixbuf library - test compositing
++ *
++ * Copyright (C) 2015 Red Hat, Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, see <http://www.gnu.org/licenses/>.
++ *
++ * Author: Benjamin Otte
++ */
++
++#include <gdk-pixbuf.h>
++
++static void
++test_original (void)
++{
++  GdkPixbuf* buf;
++  int size = 32;
++  GError* err = NULL;
++
++  buf = gdk_pixbuf_new_from_resource_at_scale 
("/test/resource/cve-2015-4491.bmp", size, size, FALSE, &err);
++
++  g_assert_no_error (err);
++
++  g_object_unref (buf);
++}
++
++static void
++test_scale_overflow (void)
++{
++  GdkPixbuf *src, *dest;
++
++  src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, 1 << 12, 1 << 12);
++  dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++  g_object_unref (dest);
++  g_object_unref (src);
++
++}
++
++static void
++test_scalex_overflow (void)
++{
++  GdkPixbuf *src, *dest;
++
++  src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, (((guint) G_MAXINT) + 
1) >> 7, 1);
++  dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++  g_object_unref (dest);
++  g_object_unref (src);
++
++}
++
++static void
++test_scaley_overflow (void)
++{
++  GdkPixbuf *src, *dest;
++
++  src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, 1, (((guint) G_MAXINT) 
+ 1) >> 7);
++  dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++  g_object_unref (dest);
++  g_object_unref (src);
++
++}
++
++int
++main (int argc, char *argv[])
++{
++  g_test_init (&argc, &argv, NULL);
++
++  g_test_add_func ("/pixbuf/cve-2015-4491/original", test_original);
++  g_test_add_func ("/pixbuf/cve-2015-4491/scale-overflow", 
test_scale_overflow);
++  g_test_add_func ("/pixbuf/cve-2015-4491/scale-x-overflow", 
test_scalex_overflow);
++  g_test_add_func ("/pixbuf/cve-2015-4491/scale-y-overflow", 
test_scaley_overflow);
++
++  return g_test_run ();
++}
+diff --git a/tests/resources.gresource.xml b/tests/resources.gresource.xml
+index 3114289..94c7b0a 100644
+--- a/tests/resources.gresource.xml
++++ b/tests/resources.gresource.xml
+@@ -3,6 +3,7 @@
+   <gresource prefix="/test/resource">
+     <file>icc-profile.png</file>
+     <file preprocess="to-pixdata" 
alias="icc-profile.pixdata">icc-profile.png</file>
++    <file>cve-2015-4491.bmp</file>
+   </gresource>
+ </gresources>
+  
+-- 
+cgit v0.11.2
+
diff --git a/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch 
b/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch
new file mode 100644
index 0000000..06370c1
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch
@@ -0,0 +1,85 @@
+From ffec86ed5010c5a2be14f47b33bcf4ed3169a199 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen AT redhat.com>
+Date: Mon, 13 Jul 2015 00:33:40 -0400
+Subject: pixops: Be more careful about integer overflow
+
+Our loader code is supposed to handle out-of-memory and overflow
+situations gracefully, reporting errors instead of aborting. But
+if you load an image at a specific size, we also execute our
+scaling code, which was not careful enough about overflow in some
+places.
+
+This commit makes the scaling code silently return if it fails to
+allocate filter tables. This is the best we can do, since
+gdk_pixbuf_scale() is not taking a GError.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=752297
+---
+ gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
+index 29a1c14..ce51745 100644
+--- a/gdk-pixbuf/pixops/pixops.c
++++ b/gdk-pixbuf/pixops/pixops.c
+@@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter)
+   int i_offset, j_offset;
+   int n_x = filter->x.n;
+   int n_y = filter->y.n;
+-  int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y);
++  gsize n_weights;
++  int *weights;
++
++  n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
++  if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
++    return NULL; /* overflow, bail */
++
++  weights = g_try_new (int, n_weights);
++  if (!weights)
++    return NULL; /* overflow, bail */
+ 
+   for (i_offset=0; i_offset < SUBSAMPLE; i_offset++)
+     for (j_offset=0; j_offset < SUBSAMPLE; j_offset++)
+@@ -1347,8 +1356,11 @@ pixops_process (guchar         *dest_buf,
+   if (x_step == 0 || y_step == 0)
+     return; /* overflow, bail out */
+ 
+-  line_bufs = g_new (guchar *, filter->y.n);
+   filter_weights = make_filter_table (filter);
++  if (!filter_weights)
++    return; /* overflow, bail out */
++
++  line_bufs = g_new (guchar *, filter->y.n);
+ 
+   check_shift = check_size ? get_check_shift (check_size) : 0;
+ 
+@@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim,
+                  double                 scale)
+ {
+   int n = ceil (1 / scale + 1);
+-  double *pixel_weights = g_new (double, SUBSAMPLE * n);
++  double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+   int offset;
+   int i;
+ 
+@@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension 
*dim,
+     }
+ 
+   dim->n = n;
+-  dim->weights = g_new (double, SUBSAMPLE * n);
++  dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+ 
+   pixel_weights = dim->weights;
+ 
+@@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim,
+                          double                 scale)
+ {
+   int n = ceil (1/scale + 3.0);
+-  double *pixel_weights = g_new (double, SUBSAMPLE * n);
++  double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+   double w;
+   int offset, i;
+ 
+-- 
+cgit v0.11.2
+
diff --git a/security/wireshark/DETAILS b/security/wireshark/DETAILS
index 1b85eed..0d45c5c 100755
--- a/security/wireshark/DETAILS
+++ b/security/wireshark/DETAILS
@@ -1,11 +1,15 @@
            SPELL=wireshark
-         VERSION=1.12.7
-  SECURITY_PATCH=55
+         VERSION=1.12.8
+  SECURITY_PATCH=56
           SOURCE=$SPELL-$VERSION.tar.bz2
+   SOURCE_URL[0]=https://www.wireshark.org/download/src/$SOURCE
+   SOURCE_URL[1]=https://www.wireshark.org/download/src/all-versions/$SOURCE
+   SOURCE_URL[2]=https://1.na.dl.wireshark.org/src/all-versions/$SOURCE
+   SOURCE_URL[3]=https://2.na.dl.wireshark.org/src/all-versions/$SOURCE
+   SOURCE_URL[4]=https://1.eu.dl.wireshark.org/src/all-versions/$SOURCE
+   SOURCE_URL[5]=https://1.as.dl.wireshark.org/src/all-versions/$SOURCE
+     
SOURCE_HASH=sha512:24ad130d9d0718e610f7def2a08e976871205032b4b4b5269c3ae54894c4121fa3b21a0bc6e45e9c2a41119f5553416d5c452dadf7b02f17e7803511d33809f5
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
-   SOURCE_URL[0]=$SOURCEFORGE_URL/$SPELL/$SOURCE
-   SOURCE_URL[1]=http://www.wireshark.org/download/src/$SOURCE
-     
SOURCE_HASH=sha512:a4012fa56e8b99e5fb072c1fb82c783a547395ddb013a9473858fdf9fa99270313d6059f9ee210d56c00f420bbad9cab30bdd3c45e9ff07d4f5967c18d1d0f38
         WEB_SITE=http://www.wireshark.org/
          ENTERED=20020116
       LICENSE[0]=GPL
diff --git a/security/wireshark/HISTORY b/security/wireshark/HISTORY
index c855dd3..8eb1c10 100644
--- a/security/wireshark/HISTORY
+++ b/security/wireshark/HISTORY
@@ -1,3 +1,6 @@
+2015-12-24 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: updated spell to 1.12.8, SECURITY_PATCH++; updated mirrors
+
 2015-08-13 Ladislav Hagara <hgr AT vabo.cz>
        * DETAILS: 1.12.7, SECURITY_PATCH=55