media-gfx/gimp/files/gimp-2.9.2-CVE-2016-4994.patch

   1 From 6d804bf9ae77bc86a0a97f9b944a129844df9395 Mon Sep 17 00:00:00 2001
   2 From: Shmuel H <shmuelgimp@gmail.com>
   3 Date: Mon, 20 Jun 2016 17:14:41 +0300
   4 Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
   5
   6 ...XCF channel and layer properties
   7
   8 The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
   9 PROP_ACTIVE_CHANNEL saves the current object pointer the @info
  10 structure. Others like PROP_SELECTION (for channel) and
  11 PROP_GROUP_ITEM (for layer) will delete the current object and create
  12 a new object, leaving the pointers in @info invalid (dangling).
  13
  14 Therefore, if a property from the first type will come before the
  15 second, the result will be an UaF in the last lines of xcf_load_image
  16 (when it actually using the pointers from @info).
  17
  18 I wasn't able to exploit this bug because that
  19 g_object_instance->c_class gets cleared by the last g_object_unref and
  20 GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
  21 ---
  22  app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
  23  1 file changed, 29 insertions(+)
  24
  25 diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
  26 index f48558a..244d5c2 100644
  27 --- a/app/xcf/xcf-load.c
  28 +++ b/app/xcf/xcf-load.c
  29 @@ -1141,6 +1141,18 @@ xcf_load_layer_props (XcfInfo    *info,
  30          case PROP_GROUP_ITEM:
  31            {
  32              GimpLayer *group;
  33 +            gboolean   is_active_layer;
  34 +
  35 +            /* We're going to delete *layer, Don't leave its pointers
  36 +             * in @info.  After that, we'll restore them back with the
  37 +             * new pointer. See bug #767873.
  38 +             */
  39 +            is_active_layer = (*layer == info->active_layer);
  40 +            if (is_active_layer)
  41 +              info->active_layer = NULL;
  42 +
  43 +            if (*layer == info->floating_sel)
  44 +              info->floating_sel = NULL;
  45
  46              group = gimp_group_layer_new (image);
  47
  48 @@ -1150,6 +1162,13 @@ xcf_load_layer_props (XcfInfo    *info,
  49              g_object_ref_sink (*layer);
  50              g_object_unref (*layer);
  51              *layer = group;
  52 +
  53 +            if (is_active_layer)
  54 +              info->active_layer = *layer;
  55 +
  56 +            /* Don't restore info->floating_sel because group layers
  57 +             * can't be floating selections
  58 +             */
  59            }
  60            break;
  61
  62 @@ -1220,6 +1239,12 @@ xcf_load_channel_props (XcfInfo      *info,
  63            {
  64              GimpChannel *mask;
  65
  66 +            /* We're going to delete *channel, Don't leave its pointer
  67 +             * in @info. See bug #767873.
  68 +             */
  69 +            if (*channel == info->active_channel)
  70 +              info->active_channel = NULL;
  71 +
  72              mask =
  73                gimp_selection_new (image,
  74                                    gimp_item_get_width  (GIMP_ITEM (*channel)),
  75 @@ -1234,6 +1259,10 @@ xcf_load_channel_props (XcfInfo      *info,
  76              *channel = mask;
  77              (*channel)->boundary_known = FALSE;
  78              (*channel)->bounds_known   = FALSE;
  79 +
  80 +            /* Don't restore info->active_channel because the
  81 +             * selection can't be the active channel
  82 +             */
  83            }
  84            break;
  85
  86 --
  87 cgit v0.12
  88