Merge lp:~logan/ubuntu/raring/gegl/new-merge into lp:ubuntu/raring/gegl

[Logan Rosen]

[Didier Roche-Tolomelli (didrocks)]

Looks fine and builds well. Sponsoring :)

review: Approve

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-10-29 16:01:18 +0000
+++ .pc/applied-patches	2013-01-06 08:40:24 +0000
@@ -0,0 +1,1 @@
+cve-2012-4433.patch

=== modified file 'debian/changelog'
--- debian/changelog	2012-10-29 16:01:18 +0000
+++ debian/changelog	2013-01-06 08:40:24 +0000
@@ -1,3 +1,21 @@
+gegl (0.2.0-2+nmu1ubuntu1) raring; urgency=low
+
+  * Merge from Debiam unstable. Remaining changes:
+    - debian/control:
+      + Drop Build-Depends on libopenraw-dev (in universe).
+      + Drop Build-Depends on libavcodec-dev (can't be shipped on the CDs).
+      + Drop Build-Depends on libavformat-dev, otherwise libavcodec-dev is
+        still pulled in.
+
+ -- Logan Rosen <[e-mail]>  Sun, 06 Jan 2013 03:31:41 -0500
+
+gegl (0.2.0-2+nmu1) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * Fix cve-2012-4433: multiple buffer overflow issues (closes: #692435).
+
+ -- Michael Gilbert <[e-mail]>  Thu, 22 Nov 2012 08:04:44 +0000
+
 gegl (0.2.0-2ubuntu1) raring; urgency=low
 
   * Merge from Debian unstable. Remaining changes:

=== added directory 'debian/patches'
=== added file 'debian/patches/cve-2012-4433.patch'
--- debian/patches/cve-2012-4433.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2012-4433.patch	2013-01-06 08:40:24 +0000
@@ -0,0 +1,107 @@
+Description: Fix cve-2012-4433: multiple buffer overflow issues (closes: #692435).
+Author: Michael Gilbert <[e-mail]>
+Bug-Debian: http://bugs.debian.org/692435
+--- gegl-0.2.0.orig/operations/external/ppm-load.c
++++ gegl-0.2.0/operations/external/ppm-load.c
+@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "
+ #include "gegl-chant.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <errno.h>
+ 
+ typedef enum {
+   PIXMAP_ASCII  = 51,
+@@ -44,8 +45,8 @@ typedef enum {
+ 
+ typedef struct {
+ 	map_type   type;
+-	gint       width;
+-	gint       height;
++	glong      width;
++	glong      height;
+         gsize      numsamples; /* width * height * channels */
+         gsize      bpc;        /* bytes per channel */
+ 	guchar    *data;
+@@ -82,12 +83,33 @@ ppm_load_read_header(FILE       *fp,
+       }
+ 
+     /* Get Width and Height */
+-    img->width  = strtol (header,&ptr,0);
+-    img->height = atoi (ptr);
+-    img->numsamples = img->width * img->height * CHANNEL_COUNT;
++    errno = 0;
++    img->width  = strtol (header,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading width: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: width is negative");
++        return FALSE;
++      }
++
++    img->height = strtol (ptr,&ptr,10);
++    if (errno)
++      {
++        g_warning ("Error reading height: %s", strerror(errno));
++        return FALSE;
++      }
++    else if (img->width < 0)
++      {
++        g_warning ("Error: height is negative");
++        return FALSE;
++      }
+ 
+     fgets (header,MAX_CHARS_IN_ROW,fp);
+-    maxval = strtol (header,&ptr,0);
++    maxval = strtol (header,&ptr,10);
+ 
+     if ((maxval != 255) && (maxval != 65535))
+       {
+@@ -109,6 +131,16 @@ ppm_load_read_header(FILE       *fp,
+       g_warning ("%s: Programmer stupidity error", G_STRLOC);
+     }
+ 
++    /* Later on, img->numsamples is multiplied with img->bpc to allocate
++     * memory. Ensure it doesn't overflow. */
++    if (!img->width || !img->height ||
++        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
++      {
++        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
++        return FALSE;
++      }
++    img->numsamples = img->width * img->height * CHANNEL_COUNT;
++
+     return TRUE;
+ }
+ 
+@@ -229,12 +261,24 @@ process (GeglOperation       *operation,
+   if (!ppm_load_read_header (fp, &img))
+     goto out;
+ 
+-  rect.height = img.height;
+-  rect.width = img.width;
+-
+   /* Allocating Array Size */
++
++  /* Should use g_try_malloc(), but this causes crashes elsewhere because the
++   * error signalled by returning FALSE isn't properly acted upon. Therefore
++   * g_malloc() is used here which aborts if the requested memory size can't be
++   * allocated causing a controlled crash. */
+   img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+ 
++  /* No-op without g_try_malloc(), see above. */
++  if (! img.data)
++    {
++      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
++      goto out;
++    }
++
++  rect.height = img.height;
++  rect.width = img.width;
++
+   switch (img.bpc)
+     {
+     case 1:

=== added file 'debian/patches/series'
--- debian/patches/series	1970-01-01 00:00:00 +0000
+++ debian/patches/series	2013-01-06 08:40:24 +0000
@@ -0,0 +1,1 @@
+cve-2012-4433.patch

=== modified file 'operations/external/ppm-load.c'
--- operations/external/ppm-load.c	2012-05-06 09:36:40 +0000
+++ operations/external/ppm-load.c	2013-01-06 08:40:24 +0000
@@ -36,6 +36,7 @@
 #include "gegl-chant.h"
 #include <stdio.h>
 #include <stdlib.h>
+#include <errno.h>
 
 typedef enum {
   PIXMAP_ASCII  = 51,
@@ -44,8 +45,8 @@
 
 typedef struct {
 	map_type   type;
-	gint       width;
-	gint       height;
+	glong      width;
+	glong      height;
         gsize      numsamples; /* width * height * channels */
         gsize      bpc;        /* bytes per channel */
 	guchar    *data;
@@ -82,12 +83,33 @@
       }
 
     /* Get Width and Height */
-    img->width  = strtol (header,&ptr,0);
-    img->height = atoi (ptr);
-    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+    errno = 0;
+    img->width  = strtol (header,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading width: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: width is negative");
+        return FALSE;
+      }
+
+    img->height = strtol (ptr,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading height: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: height is negative");
+        return FALSE;
+      }
 
     fgets (header,MAX_CHARS_IN_ROW,fp);
-    maxval = strtol (header,&ptr,0);
+    maxval = strtol (header,&ptr,10);
 
     if ((maxval != 255) && (maxval != 65535))
       {
@@ -109,6 +131,16 @@
       g_warning ("%s: Programmer stupidity error", G_STRLOC);
     }
 
+    /* Later on, img->numsamples is multiplied with img->bpc to allocate
+     * memory. Ensure it doesn't overflow. */
+    if (!img->width || !img->height ||
+        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+      {
+        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
+        return FALSE;
+      }
+    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+
     return TRUE;
 }
 
@@ -229,12 +261,24 @@
   if (!ppm_load_read_header (fp, &img))
     goto out;
 
+  /* Allocating Array Size */
+
+  /* Should use g_try_malloc(), but this causes crashes elsewhere because the
+   * error signalled by returning FALSE isn't properly acted upon. Therefore
+   * g_malloc() is used here which aborts if the requested memory size can't be
+   * allocated causing a controlled crash. */
+  img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
+
+  /* No-op without g_try_malloc(), see above. */
+  if (! img.data)
+    {
+      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
+      goto out;
+    }
+
   rect.height = img.height;
   rect.width = img.width;
 
-  /* Allocating Array Size */
-  img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
-
   switch (img.bpc)
     {
     case 1: