Control: tags 828179 + pending
Dear maintainer,
I've prepared an NMU for gimp (versioned as 2.8.16-2.2) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer or cancel at all if you want to do the upload
including some other changes as well.
Thanks for all you work!
Regards,
Salvatore
diff -Nru gimp-2.8.16/debian/changelog gimp-2.8.16/debian/changelog
--- gimp-2.8.16/debian/changelog 2016-07-04 14:26:58.000000000 +0200
+++ gimp-2.8.16/debian/changelog 2016-07-05 09:39:51.000000000 +0200
@@ -1,3 +1,11 @@
+gimp (2.8.16-2.2) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2016-4994: Use-after-free vulnerabilities in the channel and layer
+ properties parsing process (Closes: #828179)
+
+ -- Salvatore Bonaccorso <car...@debian.org> Tue, 05 Jul 2016 09:39:12 +0200
+
gimp (2.8.16-2.1) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru gimp-2.8.16/debian/patches/CVE-2016-4994.patch gimp-2.8.16/debian/patches/CVE-2016-4994.patch
--- gimp-2.8.16/debian/patches/CVE-2016-4994.patch 1970-01-01 01:00:00.000000000 +0100
+++ gimp-2.8.16/debian/patches/CVE-2016-4994.patch 2016-07-05 09:39:51.000000000 +0200
@@ -0,0 +1,90 @@
+From e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f Mon Sep 17 00:00:00 2001
+From: Shmuel H <shmuelg...@gmail.com>
+Date: Mon, 20 Jun 2016 17:14:41 +0300
+Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing...
+
+...XCF channel and layer properties
+
+The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
+PROP_ACTIVE_CHANNEL saves the current object pointer the @info
+structure. Others like PROP_SELECTION (for channel) and
+PROP_GROUP_ITEM (for layer) will delete the current object and create
+a new object, leaving the pointers in @info invalid (dangling).
+
+Therefore, if a property from the first type will come before the
+second, the result will be an UaF in the last lines of xcf_load_image
+(when it actually using the pointers from @info).
+
+I wasn't able to exploit this bug because that
+g_object_instance->c_class gets cleared by the last g_object_unref and
+GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
+
+(cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395)
+---
+ app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c
+index b180377..67cc6d4 100644
+--- a/app/xcf/xcf-load.c
++++ b/app/xcf/xcf-load.c
+@@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info,
+ case PROP_GROUP_ITEM:
+ {
+ GimpLayer *group;
++ gboolean is_active_layer;
++
++ /* We're going to delete *layer, Don't leave its pointers
++ * in @info. After that, we'll restore them back with the
++ * new pointer. See bug #767873.
++ */
++ is_active_layer = (*layer == info->active_layer);
++ if (is_active_layer)
++ info->active_layer = NULL;
++
++ if (*layer == info->floating_sel)
++ info->floating_sel = NULL;
+
+ group = gimp_group_layer_new (image);
+
+@@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info,
+ g_object_ref_sink (*layer);
+ g_object_unref (*layer);
+ *layer = group;
++
++ if (is_active_layer)
++ info->active_layer = *layer;
++
++ /* Don't restore info->floating_sel because group layers
++ * can't be floating selections
++ */
+ }
+ break;
+
+@@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info,
+ {
+ GimpChannel *mask;
+
++ /* We're going to delete *channel, Don't leave its pointer
++ * in @info. See bug #767873.
++ */
++ if (*channel == info->active_channel)
++ info->active_channel = NULL;
++
+ mask =
+ gimp_selection_new (image,
+ gimp_item_get_width (GIMP_ITEM (*channel)),
+@@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info,
+ *channel = mask;
+ (*channel)->boundary_known = FALSE;
+ (*channel)->bounds_known = FALSE;
++
++ /* Don't restore info->active_channel because the
++ * selection can't be the active channel
++ */
+ }
+ break;
+
+--
+cgit v0.12
+
diff -Nru gimp-2.8.16/debian/patches/series gimp-2.8.16/debian/patches/series
--- gimp-2.8.16/debian/patches/series 2016-07-04 14:18:14.000000000 +0200
+++ gimp-2.8.16/debian/patches/series 2016-07-05 09:39:51.000000000 +0200
@@ -2,3 +2,4 @@
01_hurd_ftbfs.patch
bump_Babl-GEGL_versions.patch
fix_GEGL_FTBFS.patch
+CVE-2016-4994.patch
