Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (7689f91b88b50a2cc9b161be117ba2d2803bb9a6)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (7689f91b88b50a2cc9b161be117ba2d2803bb9a6)
  • Date: Thu, 24 Dec 2015 10:49:39 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

gnome2-libs/gdk-pixbuf2/DETAILS | 3
gnome2-libs/gdk-pixbuf2/HISTORY | 6
gnome2-libs/gdk-pixbuf2/PRE_BUILD | 5
gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch | 178
++++++++++++++++++++++++
gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch | 85 +++++++++++
security/wireshark/DETAILS | 14 +
security/wireshark/HISTORY | 3
7 files changed, 287 insertions(+), 7 deletions(-)

New commits:
commit 7689f91b88b50a2cc9b161be117ba2d2803bb9a6
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

gdk-pixbuf2: security update

commit 8fddfa93b301934a23d969d21c119824baa62e00
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

wireshark: => 1.12.8 [security]

(cherry picked from commit 18a1ab8c2ed4b0cc73fe203edea4f41c4b29be03)

Conflicts:
security/wireshark/DETAILS

diff --git a/gnome2-libs/gdk-pixbuf2/DETAILS b/gnome2-libs/gdk-pixbuf2/DETAILS
index 27b0913..3a0de85 100755
--- a/gnome2-libs/gdk-pixbuf2/DETAILS
+++ b/gnome2-libs/gdk-pixbuf2/DETAILS
@@ -1,8 +1,7 @@
SPELL=gdk-pixbuf2
VERSION=2.30.8

SOURCE_HASH=sha512:2888cf035b70330e8d3ac87af54b69b2c990440fd59922464088d2a685e90022ad39c83d1ce1ccccfac3872b55ce9445ec4a3e9c7ab6371e20b19e20df7f261d
- SECURITY_PATCH=1
- PATCHLEVEL=0
+ SECURITY_PATCH=2
BRANCH=`echo $VERSION|cut -d . -f 1,2`
SOURCE=gdk-pixbuf-$VERSION.tar.xz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/gdk-pixbuf-$VERSION
diff --git a/gnome2-libs/gdk-pixbuf2/HISTORY b/gnome2-libs/gdk-pixbuf2/HISTORY
index 0db7cdc..d577e7d 100644
--- a/gnome2-libs/gdk-pixbuf2/HISTORY
+++ b/gnome2-libs/gdk-pixbuf2/HISTORY
@@ -1,3 +1,9 @@
+2015-12-24 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * PRE_BUILD: added, to apply patch
+ * cve-2015-4491{,_pre}.patch: added, official patches to fix
heap-based
+ buffer overflow and application crash (CVE-2015-4491)
+
2015-05-10 Vlad Glagolev <stealth AT sourcemage.org>
* DEPENDS: LZMA -> xz-utils

diff --git a/gnome2-libs/gdk-pixbuf2/PRE_BUILD
b/gnome2-libs/gdk-pixbuf2/PRE_BUILD
new file mode 100755
index 0000000..ddd2108
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/PRE_BUILD
@@ -0,0 +1,5 @@
+default_pre_build &&
+cd "$SOURCE_DIRECTORY" &&
+
+patch -p1 < "$SPELL_DIRECTORY/cve-2015-4491_pre.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/cve-2015-4491.patch"
diff --git a/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch
b/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch
new file mode 100644
index 0000000..0bbba94
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/cve-2015-4491.patch
@@ -0,0 +1,178 @@
+From 8dba67cb4f38d62a47757741ad41e3f245b4a32a Mon Sep 17 00:00:00 2001
+From: Benjamin Otte <otte AT redhat.com>
+Date: Mon, 17 Aug 2015 18:52:47 +0200
+Subject: pixops: Fix oversight for CVE-2015-4491
+
+The n_x variable could be made large enough to overflow, too.
+
+Also included are various testcases for this vulnerability:
+- The original exploit (adapted for the testsuite)
+- Causing overflow by making both X and Y variables large
+- Causing overflow using only the X variable
+- Causing overflow using only the Y variable
+
+https://bugzilla.gnome.org/show_bug.cgi?id=752297
+---
+ gdk-pixbuf/pixops/pixops.c | 6 ++-
+ tests/Makefile.am | 7 ++++
+ tests/cve-2015-4491.bmp | Bin 0 -> 82 bytes
+ tests/cve-2015-4491.c | 87
++++++++++++++++++++++++++++++++++++++++++
+ tests/resources.gresource.xml | 1 +
+ 5 files changed, 100 insertions(+), 1 deletion(-)
+ create mode 100644 tests/cve-2015-4491.bmp
+ create mode 100644 tests/cve-2015-4491.c
+
+diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
+index ce51745..7f2cbff 100644
+--- a/gdk-pixbuf/pixops/pixops.c
++++ b/gdk-pixbuf/pixops/pixops.c
+@@ -1275,7 +1275,11 @@ make_filter_table (PixopsFilter *filter)
+ gsize n_weights;
+ int *weights;
+
+- n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
++ n_weights = SUBSAMPLE * SUBSAMPLE * n_x;
++ if (n_weights / (SUBSAMPLE * SUBSAMPLE) != n_x)
++ return NULL; /* overflow, bail */
++
++ n_weights *= n_y;
+ if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
+ return NULL; /* overflow, bail */
+
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 058ad68..42db6e2 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -24,6 +24,7 @@ noinst_PROGRAMS += \
+
+ test_programs = \
+ animation \
++ cve-2015-4491 \
+ pixbuf-icon-serialize \
+ pixbuf-randomly-modified \
+ pixbuf-threads \
+@@ -54,6 +55,12 @@ dist_installed_test_data = \
+ bug725582-testrotate.png \
+ $(wildcard $(srcdir)/test-images/*)
+
++cve_2015_4491_SOURCES = \
++ cve-2015-4491.c \
++ resources.h \
++ resources.c \
++ $(NULL)
++
+ pixbuf_icc_SOURCES = \
+ pixbuf-icc.c \
+ test-common.c \
+diff --git a/tests/cve-2015-4491.bmp b/tests/cve-2015-4491.bmp
+new file mode 100644
+index 0000000..5d3c105
+Binary files /dev/null and b/tests/cve-2015-4491.bmp differ
+diff --git a/tests/cve-2015-4491.c b/tests/cve-2015-4491.c
+new file mode 100644
+index 0000000..34ba94f
+--- /dev/null
++++ b/tests/cve-2015-4491.c
+@@ -0,0 +1,87 @@
++/* GdkPixbuf library - test compositing
++ *
++ * Copyright (C) 2015 Red Hat, Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, see <http://www.gnu.org/licenses/>.
++ *
++ * Author: Benjamin Otte
++ */
++
++#include <gdk-pixbuf.h>
++
++static void
++test_original (void)
++{
++ GdkPixbuf* buf;
++ int size = 32;
++ GError* err = NULL;
++
++ buf = gdk_pixbuf_new_from_resource_at_scale
("/test/resource/cve-2015-4491.bmp", size, size, FALSE, &err);
++
++ g_assert_no_error (err);
++
++ g_object_unref (buf);
++}
++
++static void
++test_scale_overflow (void)
++{
++ GdkPixbuf *src, *dest;
++
++ src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, 1 << 12, 1 << 12);
++ dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++ g_object_unref (dest);
++ g_object_unref (src);
++
++}
++
++static void
++test_scalex_overflow (void)
++{
++ GdkPixbuf *src, *dest;
++
++ src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, (((guint) G_MAXINT) +
1) >> 7, 1);
++ dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++ g_object_unref (dest);
++ g_object_unref (src);
++
++}
++
++static void
++test_scaley_overflow (void)
++{
++ GdkPixbuf *src, *dest;
++
++ src = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, 1, (((guint) G_MAXINT)
+ 1) >> 7);
++ dest = gdk_pixbuf_scale_simple (src, 1, 1, GDK_INTERP_BILINEAR);
++
++ g_object_unref (dest);
++ g_object_unref (src);
++
++}
++
++int
++main (int argc, char *argv[])
++{
++ g_test_init (&argc, &argv, NULL);
++
++ g_test_add_func ("/pixbuf/cve-2015-4491/original", test_original);
++ g_test_add_func ("/pixbuf/cve-2015-4491/scale-overflow",
test_scale_overflow);
++ g_test_add_func ("/pixbuf/cve-2015-4491/scale-x-overflow",
test_scalex_overflow);
++ g_test_add_func ("/pixbuf/cve-2015-4491/scale-y-overflow",
test_scaley_overflow);
++
++ return g_test_run ();
++}
+diff --git a/tests/resources.gresource.xml b/tests/resources.gresource.xml
+index 3114289..94c7b0a 100644
+--- a/tests/resources.gresource.xml
++++ b/tests/resources.gresource.xml
+@@ -3,6 +3,7 @@
+ <gresource prefix="/test/resource">
+ <file>icc-profile.png</file>
+ <file preprocess="to-pixdata"
alias="icc-profile.pixdata">icc-profile.png</file>
++ <file>cve-2015-4491.bmp</file>
+ </gresource>
+ </gresources>
+
+--
+cgit v0.11.2
+
diff --git a/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch
b/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch
new file mode 100644
index 0000000..06370c1
--- /dev/null
+++ b/gnome2-libs/gdk-pixbuf2/cve-2015-4491_pre.patch
@@ -0,0 +1,85 @@
+From ffec86ed5010c5a2be14f47b33bcf4ed3169a199 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen AT redhat.com>
+Date: Mon, 13 Jul 2015 00:33:40 -0400
+Subject: pixops: Be more careful about integer overflow
+
+Our loader code is supposed to handle out-of-memory and overflow
+situations gracefully, reporting errors instead of aborting. But
+if you load an image at a specific size, we also execute our
+scaling code, which was not careful enough about overflow in some
+places.
+
+This commit makes the scaling code silently return if it fails to
+allocate filter tables. This is the best we can do, since
+gdk_pixbuf_scale() is not taking a GError.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=752297
+---
+ gdk-pixbuf/pixops/pixops.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/gdk-pixbuf/pixops/pixops.c b/gdk-pixbuf/pixops/pixops.c
+index 29a1c14..ce51745 100644
+--- a/gdk-pixbuf/pixops/pixops.c
++++ b/gdk-pixbuf/pixops/pixops.c
+@@ -1272,7 +1272,16 @@ make_filter_table (PixopsFilter *filter)
+ int i_offset, j_offset;
+ int n_x = filter->x.n;
+ int n_y = filter->y.n;
+- int *weights = g_new (int, SUBSAMPLE * SUBSAMPLE * n_x * n_y);
++ gsize n_weights;
++ int *weights;
++
++ n_weights = SUBSAMPLE * SUBSAMPLE * n_x * n_y;
++ if (n_weights / (SUBSAMPLE * SUBSAMPLE * n_x) != n_y)
++ return NULL; /* overflow, bail */
++
++ weights = g_try_new (int, n_weights);
++ if (!weights)
++ return NULL; /* overflow, bail */
+
+ for (i_offset=0; i_offset < SUBSAMPLE; i_offset++)
+ for (j_offset=0; j_offset < SUBSAMPLE; j_offset++)
+@@ -1347,8 +1356,11 @@ pixops_process (guchar *dest_buf,
+ if (x_step == 0 || y_step == 0)
+ return; /* overflow, bail out */
+
+- line_bufs = g_new (guchar *, filter->y.n);
+ filter_weights = make_filter_table (filter);
++ if (!filter_weights)
++ return; /* overflow, bail out */
++
++ line_bufs = g_new (guchar *, filter->y.n);
+
+ check_shift = check_size ? get_check_shift (check_size) : 0;
+
+@@ -1468,7 +1480,7 @@ tile_make_weights (PixopsFilterDimension *dim,
+ double scale)
+ {
+ int n = ceil (1 / scale + 1);
+- double *pixel_weights = g_new (double, SUBSAMPLE * n);
++ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+ int offset;
+ int i;
+
+@@ -1526,7 +1538,7 @@ bilinear_magnify_make_weights (PixopsFilterDimension
*dim,
+ }
+
+ dim->n = n;
+- dim->weights = g_new (double, SUBSAMPLE * n);
++ dim->weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+
+ pixel_weights = dim->weights;
+
+@@ -1617,7 +1629,7 @@ bilinear_box_make_weights (PixopsFilterDimension *dim,
+ double scale)
+ {
+ int n = ceil (1/scale + 3.0);
+- double *pixel_weights = g_new (double, SUBSAMPLE * n);
++ double *pixel_weights = g_malloc_n (sizeof (double) * SUBSAMPLE, n);
+ double w;
+ int offset, i;
+
+--
+cgit v0.11.2
+
diff --git a/security/wireshark/DETAILS b/security/wireshark/DETAILS
index 1b85eed..0d45c5c 100755
--- a/security/wireshark/DETAILS
+++ b/security/wireshark/DETAILS
@@ -1,11 +1,15 @@
SPELL=wireshark
- VERSION=1.12.7
- SECURITY_PATCH=55
+ VERSION=1.12.8
+ SECURITY_PATCH=56
SOURCE=$SPELL-$VERSION.tar.bz2
+ SOURCE_URL[0]=https://www.wireshark.org/download/src/$SOURCE
+ SOURCE_URL[1]=https://www.wireshark.org/download/src/all-versions/$SOURCE
+ SOURCE_URL[2]=https://1.na.dl.wireshark.org/src/all-versions/$SOURCE
+ SOURCE_URL[3]=https://2.na.dl.wireshark.org/src/all-versions/$SOURCE
+ SOURCE_URL[4]=https://1.eu.dl.wireshark.org/src/all-versions/$SOURCE
+ SOURCE_URL[5]=https://1.as.dl.wireshark.org/src/all-versions/$SOURCE
+
SOURCE_HASH=sha512:24ad130d9d0718e610f7def2a08e976871205032b4b4b5269c3ae54894c4121fa3b21a0bc6e45e9c2a41119f5553416d5c452dadf7b02f17e7803511d33809f5
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
- SOURCE_URL[0]=$SOURCEFORGE_URL/$SPELL/$SOURCE
- SOURCE_URL[1]=http://www.wireshark.org/download/src/$SOURCE
-
SOURCE_HASH=sha512:a4012fa56e8b99e5fb072c1fb82c783a547395ddb013a9473858fdf9fa99270313d6059f9ee210d56c00f420bbad9cab30bdd3c45e9ff07d4f5967c18d1d0f38
WEB_SITE=http://www.wireshark.org/
ENTERED=20020116
LICENSE[0]=GPL
diff --git a/security/wireshark/HISTORY b/security/wireshark/HISTORY
index c855dd3..8eb1c10 100644
--- a/security/wireshark/HISTORY
+++ b/security/wireshark/HISTORY
@@ -1,3 +1,6 @@
+2015-12-24 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 1.12.8, SECURITY_PATCH++; updated mirrors
+
2015-08-13 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.12.7, SECURITY_PATCH=55




  • [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (7689f91b88b50a2cc9b161be117ba2d2803bb9a6), Vlad Glagolev, 12/24/2015

Archive powered by MHonArc 2.6.24.

Top of Page