From: Michael Gilbert <mgilbert@debian.org>
Date: Mon, 9 Sep 2013 17:34:32 +0200
Subject: Fix_CVE-2012-4433

Multiple buffer overflow issues.

Closes: #692435
---
 operations/external/ppm-load.c | 62 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 9 deletions(-)

diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c
index efe6d56..465096d 100644
--- a/operations/external/ppm-load.c
+++ b/operations/external/ppm-load.c
@@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load."))
 #include "gegl-chant.h"
 #include <stdio.h>
 #include <stdlib.h>
+#include <errno.h>
 
 typedef enum {
   PIXMAP_ASCII  = 51,
@@ -44,8 +45,8 @@ typedef enum {
 
 typedef struct {
 	map_type   type;
-	gint       width;
-	gint       height;
+	glong      width;
+	glong      height;
         gsize      numsamples; /* width * height * channels */
         gsize      bpc;        /* bytes per channel */
 	guchar    *data;
@@ -82,12 +83,33 @@ ppm_load_read_header(FILE       *fp,
       }
 
     /* Get Width and Height */
-    img->width  = strtol (header,&ptr,0);
-    img->height = atoi (ptr);
-    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+    errno = 0;
+    img->width  = strtol (header,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading width: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: width is negative");
+        return FALSE;
+      }
+
+    img->height = strtol (ptr,&ptr,10);
+    if (errno)
+      {
+        g_warning ("Error reading height: %s", strerror(errno));
+        return FALSE;
+      }
+    else if (img->width < 0)
+      {
+        g_warning ("Error: height is negative");
+        return FALSE;
+      }
 
     fgets (header,MAX_CHARS_IN_ROW,fp);
-    maxval = strtol (header,&ptr,0);
+    maxval = strtol (header,&ptr,10);
 
     if ((maxval != 255) && (maxval != 65535))
       {
@@ -109,6 +131,16 @@ ppm_load_read_header(FILE       *fp,
       g_warning ("%s: Programmer stupidity error", G_STRLOC);
     }
 
+    /* Later on, img->numsamples is multiplied with img->bpc to allocate
+     * memory. Ensure it doesn't overflow. */
+    if (!img->width || !img->height ||
+        G_MAXSIZE / img->width / img->height / CHANNEL_COUNT < img->bpc)
+      {
+        g_warning ("Illegal width/height: %ld/%ld", img->width, img->height);
+        return FALSE;
+      }
+    img->numsamples = img->width * img->height * CHANNEL_COUNT;
+
     return TRUE;
 }
 
@@ -229,12 +261,24 @@ process (GeglOperation       *operation,
   if (!ppm_load_read_header (fp, &img))
     goto out;
 
-  rect.height = img.height;
-  rect.width = img.width;
-
   /* Allocating Array Size */
+
+  /* Should use g_try_malloc(), but this causes crashes elsewhere because the
+   * error signalled by returning FALSE isn't properly acted upon. Therefore
+   * g_malloc() is used here which aborts if the requested memory size can't be
+   * allocated causing a controlled crash. */
   img.data = (guchar*) g_malloc (img.numsamples * img.bpc);
 
+  /* No-op without g_try_malloc(), see above. */
+  if (! img.data)
+    {
+      g_warning ("Couldn't allocate %" G_GSIZE_FORMAT " bytes, giving up.", ((gsize)img.numsamples * img.bpc));
+      goto out;
+    }
+
+  rect.height = img.height;
+  rect.width = img.width;
+
   switch (img.bpc)
     {
     case 1:
'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Thomas Danckaert &lt;post@thomasdanckaert.be&gt;</td><td class='right'>2017-03-02 11:20:53 +0100</td></tr>
<tr><th>committer</th><td>Ludovic Courtès &lt;ludo@gnu.org&gt;</td><td class='right'>2017-03-11 22:23:28 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/gnu/packages/libedit.scm?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441'>4bff300b5356d40475eb9d1a4deafcdcb0fa0441</a> (<a href='/guix/patch/gnu/packages/libedit.scm?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441'>9ae5497f529dcb8439ef19ea5f94d534f1d55924</a> /<a href='/guix/tree/gnu/packages/libedit.scm?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441'>gnu/packages/libedit.scm</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/gnu/packages/libedit.scm?id=5578c2987e7657fd85fc0fb1c274ad00d4b173e9'>5578c2987e7657fd85fc0fb1c274ad00d4b173e9</a> (<a href='/guix/diff/gnu/packages/libedit.scm?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441&amp;id2=5578c2987e7657fd85fc0fb1c274ad00d4b173e9'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-4bff300b5356d40475eb9d1a4deafcdcb0fa0441.tar.gz'>guix-4bff300b5356d40475eb9d1a4deafcdcb0fa0441.tar.gz</a><br/><a href='/guix/snapshot/guix-4bff300b5356d40475eb9d1a4deafcdcb0fa0441.zip'>guix-4bff300b5356d40475eb9d1a4deafcdcb0fa0441.zip</a><br/></td></tr></table>
<div class='commit-subject'>gnu: Add phonon-backend-gstreamer.</div><div class='commit-msg'>* gnu/packages/kde-frameworks.scm (phonon-backend-gstreamer): New variable.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</div><div class='diffstat-header'><a href='/guix/diff/?id=4bff300b5356d40475eb9d1a4deafcdcb0fa0441'>Diffstat</a> (limited to 'gnu/packages/libedit.scm')</div><table summary='diffstat' class='diffstat'>