Date: Tuesday, November 22, 2016 @ 11:31:57 Author: anthraxx Revision: 281825
archrelease: copy trunk to staging-i686, staging-x86_64 Added: gimp/repos/staging-i686/ gimp/repos/staging-i686/PKGBUILD (from rev 281824, gimp/trunk/PKGBUILD) gimp/repos/staging-i686/freetype_location.patch (from rev 281824, gimp/trunk/freetype_location.patch) gimp/repos/staging-i686/linux.gpl (from rev 281824, gimp/trunk/linux.gpl) gimp/repos/staging-i686/patch_CVE1913.patch (from rev 281824, gimp/trunk/patch_CVE1913.patch) gimp/repos/staging-i686/patch_CVE197.patch (from rev 281824, gimp/trunk/patch_CVE197.patch) gimp/repos/staging-i686/uri-backend-libcurl.patch (from rev 281824, gimp/trunk/uri-backend-libcurl.patch) gimp/repos/staging-x86_64/ gimp/repos/staging-x86_64/PKGBUILD (from rev 281824, gimp/trunk/PKGBUILD) gimp/repos/staging-x86_64/freetype_location.patch (from rev 281824, gimp/trunk/freetype_location.patch) gimp/repos/staging-x86_64/linux.gpl (from rev 281824, gimp/trunk/linux.gpl) gimp/repos/staging-x86_64/patch_CVE1913.patch (from rev 281824, gimp/trunk/patch_CVE1913.patch) gimp/repos/staging-x86_64/patch_CVE197.patch (from rev 281824, gimp/trunk/patch_CVE197.patch) gimp/repos/staging-x86_64/uri-backend-libcurl.patch (from rev 281824, gimp/trunk/uri-backend-libcurl.patch) ------------------------------------------+ staging-i686/PKGBUILD | 49 +++++++++ staging-i686/freetype_location.patch | 25 ++++ staging-i686/linux.gpl | 19 +++ staging-i686/patch_CVE1913.patch | 30 +++++ staging-i686/patch_CVE197.patch | 150 +++++++++++++++++++++++++++++ staging-i686/uri-backend-libcurl.patch | 77 ++++++++++++++ staging-x86_64/PKGBUILD | 49 +++++++++ staging-x86_64/freetype_location.patch | 25 ++++ staging-x86_64/linux.gpl | 19 +++ staging-x86_64/patch_CVE1913.patch | 30 +++++ staging-x86_64/patch_CVE197.patch | 150 +++++++++++++++++++++++++++++ staging-x86_64/uri-backend-libcurl.patch | 77 ++++++++++++++ 12 files changed, 700 insertions(+) Copied: gimp/repos/staging-i686/PKGBUILD (from rev 281824, gimp/trunk/PKGBUILD) =================================================================== --- staging-i686/PKGBUILD (rev 0) +++ staging-i686/PKGBUILD 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,49 @@ +# $Id$ +# Maintainer: Daniel Isenmann <dan...@archlinux.org> + +pkgname=gimp +pkgver=2.8.18 +pkgrel=3 +pkgdesc="GNU Image Manipulation Program" +arch=('i686' 'x86_64') +url="http://www.gimp.org/" +license=('GPL' 'LGPL') +depends=('pygtk' 'lcms' 'libxpm' 'libwmf' 'libxmu' 'librsvg' 'libmng' 'dbus-glib' + 'libexif' 'gegl02' 'jasper' 'desktop-file-utils' 'hicolor-icon-theme' 'babl' + 'openexr' 'libgudev') +makedepends=('intltool' 'webkitgtk2' 'poppler-glib' 'alsa-lib' 'iso-codes' 'curl' 'ghostscript') +optdepends=('gutenprint: for sophisticated printing only as gimp has built-in cups print support' + 'webkitgtk2: for the help browser' + 'poppler-glib: for pdf support' + 'alsa-lib: for MIDI event controller module' + 'curl: for URI support' + 'ghostscript: for postscript support') +options=('!makeflags') +conflicts=('gimp-devel') +source=(http://download.gimp.org/pub/gimp/v${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2 linux.gpl + uri-backend-libcurl.patch) +md5sums=('5adaa11a68bc8a42bb2c778fee4d389c' + 'bb27bc214261d36484093e857f015f38' + 'e894f4b2ffa92c71448fdd350e9b78c6') + +build() { + cd "${srcdir}/${pkgname}-${pkgver}" + PYTHON=/usr/bin/python2 ./configure --prefix=/usr --sysconfdir=/etc \ + --enable-mp --enable-gimp-console --enable-gimp-remote \ + --enable-python --with-gif-compression=lzw --with-libcurl \ + --without-aa --without-hal --without-gvfs --without-gnomevfs + make +} + +package() { + cd "${srcdir}/${pkgname}-${pkgver}" + make DESTDIR="${pkgdir}" install + sed -i 's|#!/usr/bin/env python|#!/usr/bin/env python2|' "${pkgdir}"/usr/lib/gimp/2.0/plug-ins/*.py + install -D -m644 "${srcdir}/linux.gpl" "${pkgdir}/usr/share/gimp/2.0/palettes/Linux.gpl" + + rm "${pkgdir}/usr/share/man/man1/gimp-console.1" + ln -s gimp-console-${pkgver%.*}.1.gz "${pkgdir}/usr/share/man/man1/gimp-console.1.gz" + ln -s gimptool-2.0 "${pkgdir}/usr/bin/gimptool" + ln -sf gimptool-2.0.1.gz "${pkgdir}/usr/share/man/man1/gimptool.1.gz" +} + Copied: gimp/repos/staging-i686/freetype_location.patch (from rev 281824, gimp/trunk/freetype_location.patch) =================================================================== --- staging-i686/freetype_location.patch (rev 0) +++ staging-i686/freetype_location.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,25 @@ +From 6c73f28b6d87a2afd11974552a075bffec52347f Mon Sep 17 00:00:00 2001 +From: Michael Natterer <mi...@gimp.org> +Date: Fri, 29 Nov 2013 20:57:46 +0000 +Subject: Bug 719560 - Build failure with freetype 2.5.1 + +Apply patch from su-v that fixes the freetype include to +the madness devised and recommended by freetype. +--- +diff --git a/app/text/gimpfont.c b/app/text/gimpfont.c +index 4045ca9..66c6e52 100644 +--- a/app/text/gimpfont.c ++++ b/app/text/gimpfont.c +@@ -28,7 +28,9 @@ + + #define PANGO_ENABLE_ENGINE 1 /* Argh */ + #include <pango/pango-ot.h> +-#include <freetype/tttables.h> ++ ++#include <ft2build.h> ++#include FT_TRUETYPE_TABLES_H + + #include "text-types.h" + +-- +cgit v0.9.2 Copied: gimp/repos/staging-i686/linux.gpl (from rev 281824, gimp/trunk/linux.gpl) =================================================================== --- staging-i686/linux.gpl (rev 0) +++ staging-i686/linux.gpl 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,19 @@ +GIMP Palette +Name: linux +# + 0 0 0 + 0 0 170 + 0 170 0 + 0 170 170 +170 0 0 +170 0 170 +170 85 0 +170 170 170 + 85 85 85 + 85 85 255 + 85 255 85 + 85 255 255 +255 85 85 +255 85 255 +255 255 85 +255 255 255 Copied: gimp/repos/staging-i686/patch_CVE1913.patch (from rev 281824, gimp/trunk/patch_CVE1913.patch) =================================================================== --- staging-i686/patch_CVE1913.patch (rev 0) +++ staging-i686/patch_CVE1913.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,30 @@ +From 32ae0f83e5748299641cceaabe3f80f1b3afd03e Mon Sep 17 00:00:00 2001 +From: Nils Philippsen <n...@redhat.com> +Date: Thu, 14 Nov 2013 13:29:01 +0000 +Subject: file-xwd: sanity check colormap size (CVE-2013-1913) + +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index c8e1a6e..343129a 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -466,6 +466,17 @@ load_image (const gchar *filename, + /* Position to start of XWDColor structures */ + fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + ++ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only ++ * accepts colormaps with 0..256 colors anyway. */ ++ if (xwdhdr.l_colormap_entries > 256) ++ { ++ g_message (_("'%s':\nIllegal number of colormap entries: %ld"), ++ gimp_filename_to_utf8 (filename), ++ (long)xwdhdr.l_colormap_entries); ++ fclose (ifp); ++ return -1; ++ } ++ + if (xwdhdr.l_colormap_entries > 0) + { + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); +-- +cgit v0.9.2 Copied: gimp/repos/staging-i686/patch_CVE197.patch (from rev 281824, gimp/trunk/patch_CVE197.patch) =================================================================== --- staging-i686/patch_CVE197.patch (rev 0) +++ staging-i686/patch_CVE197.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,150 @@ +From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001 +From: Nils Philippsen <n...@redhat.com> +Date: Tue, 26 Nov 2013 09:49:42 +0000 +Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978) + +The number of colors in an image shouldn't be higher than the number of +colormap entries. Additionally, consolidate post error cleanup in +load_image(). +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index 343129a..4df9ce8 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -429,9 +429,9 @@ static gint32 + load_image (const gchar *filename, + GError **error) + { +- FILE *ifp; ++ FILE *ifp = NULL; + gint depth, bpp; +- gint32 image_ID; ++ gint32 image_ID = -1; + L_XWDFILEHEADER xwdhdr; + L_XWDCOLOR *xwdcolmap = NULL; + +@@ -441,7 +441,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Could not open '%s' for reading: %s"), + gimp_filename_to_utf8 (filename), g_strerror (errno)); +- return -1; ++ goto out; + } + + read_xwd_header (ifp, &xwdhdr); +@@ -450,8 +450,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Could not read XWD header from '%s'"), + gimp_filename_to_utf8 (filename)); +- fclose (ifp); +- return -1; ++ goto out; + } + + #ifdef XWD_COL_WAIT_DEBUG +@@ -473,12 +472,18 @@ load_image (const gchar *filename, + g_message (_("'%s':\nIllegal number of colormap entries: %ld"), + gimp_filename_to_utf8 (filename), + (long)xwdhdr.l_colormap_entries); +- fclose (ifp); +- return -1; ++ goto out; + } + + if (xwdhdr.l_colormap_entries > 0) + { ++ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) ++ { ++ g_message (_("'%s':\nNumber of colormap entries < number of colors"), ++ gimp_filename_to_utf8 (filename)); ++ goto out; ++ } ++ + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); + + read_xwd_cols (ifp, &xwdhdr, xwdcolmap); +@@ -498,9 +503,7 @@ load_image (const gchar *filename, + if (xwdhdr.l_file_version != 7) + { + g_message (_("Can't read color entries")); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + } + +@@ -508,9 +511,7 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nNo image width specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE +@@ -518,27 +519,21 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nImage width is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height <= 0) + { + g_message (_("'%s':\nNo image height specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) + { + g_message (_("'%s':\nImage height is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + gimp_progress_init_printf (_("Opening '%s'"), +@@ -591,11 +586,6 @@ load_image (const gchar *filename, + } + gimp_progress_update (1.0); + +- fclose (ifp); +- +- if (xwdcolmap) +- g_free (xwdcolmap); +- + if (image_ID == -1 && ! (error && *error)) + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("XWD-file %s has format %d, depth %d and bits per pixel %d. " +@@ -603,6 +593,17 @@ load_image (const gchar *filename, + gimp_filename_to_utf8 (filename), + (gint) xwdhdr.l_pixmap_format, depth, bpp); + ++out: ++ if (ifp) ++ { ++ fclose (ifp); ++ } ++ ++ if (xwdcolmap) ++ { ++ g_free (xwdcolmap); ++ } ++ + return image_ID; + } + +-- +cgit v0.9.2 Copied: gimp/repos/staging-i686/uri-backend-libcurl.patch (from rev 281824, gimp/trunk/uri-backend-libcurl.patch) =================================================================== --- staging-i686/uri-backend-libcurl.patch (rev 0) +++ staging-i686/uri-backend-libcurl.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,77 @@ +diff -aur gimp-2.6.11/plug-ins/file-uri/uri-backend-libcurl.c gimp-2.6.11.patched/plug-ins/file-uri/uri-backend-libcurl.c +--- gimp-2.6.11/plug-ins/file-uri/uri-backend-libcurl.c 2010-07-03 00:51:59.000000000 +0200 ++++ gimp-2.6.11.patched/plug-ins/file-uri/uri-backend-libcurl.c 2011-06-23 19:15:30.000000000 +0200 +@@ -4,9 +4,9 @@ + * libcurl backend for the URI plug-in + * Copyright (C) 2006 Mukund Sivaraman <m...@mukund.org> + * +- * This program is free software; you can redistribute it and/or modify ++ * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or ++ * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, +@@ -15,8 +15,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++ * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + + #include "config.h" +@@ -24,7 +23,6 @@ + #include <errno.h> + + #include <curl/curl.h> +-#include <curl/types.h> + #include <curl/easy.h> + + #include <glib/gstdio.h> +@@ -63,7 +61,7 @@ + + vinfo = curl_version_info (CURLVERSION_NOW); + +- protocols = g_string_new ("http:,ftp:"); ++ protocols = g_string_new ("http:,ftp:,gopher:"); + + if (vinfo->features & CURL_VERSION_SSL) + { +@@ -153,7 +151,7 @@ + FILE *out_file; + CURL *curl_handle; + CURLcode result; +- gint response_code; ++ glong response_code; + + gimp_progress_init (_("Connecting to server")); + +@@ -195,12 +193,12 @@ + + curl_easy_getinfo (curl_handle, CURLINFO_RESPONSE_CODE, &response_code); + +- if (response_code != 200) ++ if (response_code != 200 && response_code != 226 && response_code != 0) + { + fclose (out_file); + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Opening '%s' for reading resulted in HTTP " +- "response code: %d"), ++ "response code: %ld"), + uri, response_code); + curl_easy_cleanup (curl_handle); + return FALSE; +@@ -224,3 +222,10 @@ + + return FALSE; + } ++ ++gchar * ++uri_backend_map_image (const gchar *uri, ++ GimpRunMode run_mode) ++{ ++ return NULL; ++} Copied: gimp/repos/staging-x86_64/PKGBUILD (from rev 281824, gimp/trunk/PKGBUILD) =================================================================== --- staging-x86_64/PKGBUILD (rev 0) +++ staging-x86_64/PKGBUILD 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,49 @@ +# $Id$ +# Maintainer: Daniel Isenmann <dan...@archlinux.org> + +pkgname=gimp +pkgver=2.8.18 +pkgrel=3 +pkgdesc="GNU Image Manipulation Program" +arch=('i686' 'x86_64') +url="http://www.gimp.org/" +license=('GPL' 'LGPL') +depends=('pygtk' 'lcms' 'libxpm' 'libwmf' 'libxmu' 'librsvg' 'libmng' 'dbus-glib' + 'libexif' 'gegl02' 'jasper' 'desktop-file-utils' 'hicolor-icon-theme' 'babl' + 'openexr' 'libgudev') +makedepends=('intltool' 'webkitgtk2' 'poppler-glib' 'alsa-lib' 'iso-codes' 'curl' 'ghostscript') +optdepends=('gutenprint: for sophisticated printing only as gimp has built-in cups print support' + 'webkitgtk2: for the help browser' + 'poppler-glib: for pdf support' + 'alsa-lib: for MIDI event controller module' + 'curl: for URI support' + 'ghostscript: for postscript support') +options=('!makeflags') +conflicts=('gimp-devel') +source=(http://download.gimp.org/pub/gimp/v${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2 linux.gpl + uri-backend-libcurl.patch) +md5sums=('5adaa11a68bc8a42bb2c778fee4d389c' + 'bb27bc214261d36484093e857f015f38' + 'e894f4b2ffa92c71448fdd350e9b78c6') + +build() { + cd "${srcdir}/${pkgname}-${pkgver}" + PYTHON=/usr/bin/python2 ./configure --prefix=/usr --sysconfdir=/etc \ + --enable-mp --enable-gimp-console --enable-gimp-remote \ + --enable-python --with-gif-compression=lzw --with-libcurl \ + --without-aa --without-hal --without-gvfs --without-gnomevfs + make +} + +package() { + cd "${srcdir}/${pkgname}-${pkgver}" + make DESTDIR="${pkgdir}" install + sed -i 's|#!/usr/bin/env python|#!/usr/bin/env python2|' "${pkgdir}"/usr/lib/gimp/2.0/plug-ins/*.py + install -D -m644 "${srcdir}/linux.gpl" "${pkgdir}/usr/share/gimp/2.0/palettes/Linux.gpl" + + rm "${pkgdir}/usr/share/man/man1/gimp-console.1" + ln -s gimp-console-${pkgver%.*}.1.gz "${pkgdir}/usr/share/man/man1/gimp-console.1.gz" + ln -s gimptool-2.0 "${pkgdir}/usr/bin/gimptool" + ln -sf gimptool-2.0.1.gz "${pkgdir}/usr/share/man/man1/gimptool.1.gz" +} + Copied: gimp/repos/staging-x86_64/freetype_location.patch (from rev 281824, gimp/trunk/freetype_location.patch) =================================================================== --- staging-x86_64/freetype_location.patch (rev 0) +++ staging-x86_64/freetype_location.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,25 @@ +From 6c73f28b6d87a2afd11974552a075bffec52347f Mon Sep 17 00:00:00 2001 +From: Michael Natterer <mi...@gimp.org> +Date: Fri, 29 Nov 2013 20:57:46 +0000 +Subject: Bug 719560 - Build failure with freetype 2.5.1 + +Apply patch from su-v that fixes the freetype include to +the madness devised and recommended by freetype. +--- +diff --git a/app/text/gimpfont.c b/app/text/gimpfont.c +index 4045ca9..66c6e52 100644 +--- a/app/text/gimpfont.c ++++ b/app/text/gimpfont.c +@@ -28,7 +28,9 @@ + + #define PANGO_ENABLE_ENGINE 1 /* Argh */ + #include <pango/pango-ot.h> +-#include <freetype/tttables.h> ++ ++#include <ft2build.h> ++#include FT_TRUETYPE_TABLES_H + + #include "text-types.h" + +-- +cgit v0.9.2 Copied: gimp/repos/staging-x86_64/linux.gpl (from rev 281824, gimp/trunk/linux.gpl) =================================================================== --- staging-x86_64/linux.gpl (rev 0) +++ staging-x86_64/linux.gpl 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,19 @@ +GIMP Palette +Name: linux +# + 0 0 0 + 0 0 170 + 0 170 0 + 0 170 170 +170 0 0 +170 0 170 +170 85 0 +170 170 170 + 85 85 85 + 85 85 255 + 85 255 85 + 85 255 255 +255 85 85 +255 85 255 +255 255 85 +255 255 255 Copied: gimp/repos/staging-x86_64/patch_CVE1913.patch (from rev 281824, gimp/trunk/patch_CVE1913.patch) =================================================================== --- staging-x86_64/patch_CVE1913.patch (rev 0) +++ staging-x86_64/patch_CVE1913.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,30 @@ +From 32ae0f83e5748299641cceaabe3f80f1b3afd03e Mon Sep 17 00:00:00 2001 +From: Nils Philippsen <n...@redhat.com> +Date: Thu, 14 Nov 2013 13:29:01 +0000 +Subject: file-xwd: sanity check colormap size (CVE-2013-1913) + +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index c8e1a6e..343129a 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -466,6 +466,17 @@ load_image (const gchar *filename, + /* Position to start of XWDColor structures */ + fseek (ifp, (long)xwdhdr.l_header_size, SEEK_SET); + ++ /* Guard against insanely huge color maps -- gimp_image_set_colormap() only ++ * accepts colormaps with 0..256 colors anyway. */ ++ if (xwdhdr.l_colormap_entries > 256) ++ { ++ g_message (_("'%s':\nIllegal number of colormap entries: %ld"), ++ gimp_filename_to_utf8 (filename), ++ (long)xwdhdr.l_colormap_entries); ++ fclose (ifp); ++ return -1; ++ } ++ + if (xwdhdr.l_colormap_entries > 0) + { + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); +-- +cgit v0.9.2 Copied: gimp/repos/staging-x86_64/patch_CVE197.patch (from rev 281824, gimp/trunk/patch_CVE197.patch) =================================================================== --- staging-x86_64/patch_CVE197.patch (rev 0) +++ staging-x86_64/patch_CVE197.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,150 @@ +From 23f685931e5f000dd033a45c60c1e60d7f78caf4 Mon Sep 17 00:00:00 2001 +From: Nils Philippsen <n...@redhat.com> +Date: Tue, 26 Nov 2013 09:49:42 +0000 +Subject: file-xwd: sanity check # of colors and map entries (CVE-2013-1978) + +The number of colors in an image shouldn't be higher than the number of +colormap entries. Additionally, consolidate post error cleanup in +load_image(). +--- +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index 343129a..4df9ce8 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -429,9 +429,9 @@ static gint32 + load_image (const gchar *filename, + GError **error) + { +- FILE *ifp; ++ FILE *ifp = NULL; + gint depth, bpp; +- gint32 image_ID; ++ gint32 image_ID = -1; + L_XWDFILEHEADER xwdhdr; + L_XWDCOLOR *xwdcolmap = NULL; + +@@ -441,7 +441,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Could not open '%s' for reading: %s"), + gimp_filename_to_utf8 (filename), g_strerror (errno)); +- return -1; ++ goto out; + } + + read_xwd_header (ifp, &xwdhdr); +@@ -450,8 +450,7 @@ load_image (const gchar *filename, + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Could not read XWD header from '%s'"), + gimp_filename_to_utf8 (filename)); +- fclose (ifp); +- return -1; ++ goto out; + } + + #ifdef XWD_COL_WAIT_DEBUG +@@ -473,12 +472,18 @@ load_image (const gchar *filename, + g_message (_("'%s':\nIllegal number of colormap entries: %ld"), + gimp_filename_to_utf8 (filename), + (long)xwdhdr.l_colormap_entries); +- fclose (ifp); +- return -1; ++ goto out; + } + + if (xwdhdr.l_colormap_entries > 0) + { ++ if (xwdhdr.l_colormap_entries < xwdhdr.l_ncolors) ++ { ++ g_message (_("'%s':\nNumber of colormap entries < number of colors"), ++ gimp_filename_to_utf8 (filename)); ++ goto out; ++ } ++ + xwdcolmap = g_new (L_XWDCOLOR, xwdhdr.l_colormap_entries); + + read_xwd_cols (ifp, &xwdhdr, xwdcolmap); +@@ -498,9 +503,7 @@ load_image (const gchar *filename, + if (xwdhdr.l_file_version != 7) + { + g_message (_("Can't read color entries")); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + } + +@@ -508,9 +511,7 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nNo image width specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_width > GIMP_MAX_IMAGE_SIZE +@@ -518,27 +519,21 @@ load_image (const gchar *filename, + { + g_message (_("'%s':\nImage width is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height <= 0) + { + g_message (_("'%s':\nNo image height specified"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + if (xwdhdr.l_pixmap_height > GIMP_MAX_IMAGE_SIZE) + { + g_message (_("'%s':\nImage height is larger than GIMP can handle"), + gimp_filename_to_utf8 (filename)); +- g_free (xwdcolmap); +- fclose (ifp); +- return (-1); ++ goto out; + } + + gimp_progress_init_printf (_("Opening '%s'"), +@@ -591,11 +586,6 @@ load_image (const gchar *filename, + } + gimp_progress_update (1.0); + +- fclose (ifp); +- +- if (xwdcolmap) +- g_free (xwdcolmap); +- + if (image_ID == -1 && ! (error && *error)) + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("XWD-file %s has format %d, depth %d and bits per pixel %d. " +@@ -603,6 +593,17 @@ load_image (const gchar *filename, + gimp_filename_to_utf8 (filename), + (gint) xwdhdr.l_pixmap_format, depth, bpp); + ++out: ++ if (ifp) ++ { ++ fclose (ifp); ++ } ++ ++ if (xwdcolmap) ++ { ++ g_free (xwdcolmap); ++ } ++ + return image_ID; + } + +-- +cgit v0.9.2 Copied: gimp/repos/staging-x86_64/uri-backend-libcurl.patch (from rev 281824, gimp/trunk/uri-backend-libcurl.patch) =================================================================== --- staging-x86_64/uri-backend-libcurl.patch (rev 0) +++ staging-x86_64/uri-backend-libcurl.patch 2016-11-22 11:31:57 UTC (rev 281825) @@ -0,0 +1,77 @@ +diff -aur gimp-2.6.11/plug-ins/file-uri/uri-backend-libcurl.c gimp-2.6.11.patched/plug-ins/file-uri/uri-backend-libcurl.c +--- gimp-2.6.11/plug-ins/file-uri/uri-backend-libcurl.c 2010-07-03 00:51:59.000000000 +0200 ++++ gimp-2.6.11.patched/plug-ins/file-uri/uri-backend-libcurl.c 2011-06-23 19:15:30.000000000 +0200 +@@ -4,9 +4,9 @@ + * libcurl backend for the URI plug-in + * Copyright (C) 2006 Mukund Sivaraman <m...@mukund.org> + * +- * This program is free software; you can redistribute it and/or modify ++ * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +- * the Free Software Foundation; either version 2 of the License, or ++ * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, +@@ -15,8 +15,7 @@ + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++ * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + + #include "config.h" +@@ -24,7 +23,6 @@ + #include <errno.h> + + #include <curl/curl.h> +-#include <curl/types.h> + #include <curl/easy.h> + + #include <glib/gstdio.h> +@@ -63,7 +61,7 @@ + + vinfo = curl_version_info (CURLVERSION_NOW); + +- protocols = g_string_new ("http:,ftp:"); ++ protocols = g_string_new ("http:,ftp:,gopher:"); + + if (vinfo->features & CURL_VERSION_SSL) + { +@@ -153,7 +151,7 @@ + FILE *out_file; + CURL *curl_handle; + CURLcode result; +- gint response_code; ++ glong response_code; + + gimp_progress_init (_("Connecting to server")); + +@@ -195,12 +193,12 @@ + + curl_easy_getinfo (curl_handle, CURLINFO_RESPONSE_CODE, &response_code); + +- if (response_code != 200) ++ if (response_code != 200 && response_code != 226 && response_code != 0) + { + fclose (out_file); + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Opening '%s' for reading resulted in HTTP " +- "response code: %d"), ++ "response code: %ld"), + uri, response_code); + curl_easy_cleanup (curl_handle); + return FALSE; +@@ -224,3 +222,10 @@ + + return FALSE; + } ++ ++gchar * ++uri_backend_map_image (const gchar *uri, ++ GimpRunMode run_mode) ++{ ++ return NULL; ++}