
Hello community, here is the log from the commit of package gimp-unstable checked in at Fri May 4 17:19:32 CEST 2007. -------- --- GNOME/gimp-unstable/gimp-unstable.changes 2007-04-04 18:23:49.000000000 +0200 +++ /mounts/work_src_done/STABLE/gimp-unstable/gimp-unstable.changes 2007-05-04 15:32:01.000000000 +0200 @@ -1,0 +2,6 @@ +Fri May 4 15:32:01 CEST 2007 - sbrabec@suse.cz + +- Fixed buffer overflow in sunras plugin (#270506, GNOME#433902, + CVE-2007-2356). + +------------------------------------------------------------------- New: ---- gimp-sunras-overflow.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp-unstable.spec ++++++ --- /var/tmp/diff_new_pack.w20188/_old 2007-05-04 17:19:11.000000000 +0200 +++ /var/tmp/diff_new_pack.w20188/_new 2007-05-04 17:19:11.000000000 +0200 @@ -21,7 +21,7 @@ %define _name gimp URL: http://www.gimp.org/ Version: 2.3.15 -Release: 1 +Release: 9 License: GNU General Public License (GPL) Group: Productivity/Graphics/Bitmap Editors Requires: gnome-icon-theme glib2 >= 2.10.2 gtk2 >= 2.8.17 @@ -33,6 +33,7 @@ Autoreqprov: on Summary: The GNU Image Manipulation Program--Development Branch Source: ftp://ftp.gimp.org/pub/gimp/v2.3/%{_name}-%{version}.tar.bz2 +Patch: gimp-sunras-overflow.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -636,6 +637,7 @@ %prep %setup -q -n %{_name}-%{version} +%patch # We can ignore these warnings: # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22197 # spline.c: 44 @@ -701,6 +703,9 @@ %{_datadir}/gtk-doc/html/* %changelog +* Fri May 04 2007 - sbrabec@suse.cz +- Fixed buffer overflow in sunras plugin (#270506, GNOME#433902, + CVE-2007-2356). * Wed Apr 04 2007 - sbrabec@suse.cz - Updated to version gimp-2.3.15: * Fixes, improvements, UI and API changes. See NEWS for more. ++++++ gimp-sunras-overflow.patch ++++++ ------------------------------------------------------------------------ r22356 | neo | 2007-04-27 13:50:58 +0200 (Pá, 27 dub 2007) | 8 lines 2007-04-27 Sven Neumann <sven@gimp.org> Merged from trunk: * plug-ins/common/sunras.c (set_color_table): guard against a possible stack overflow. ------------------------------------------------------------------------ Index: sunras.c =================================================================== --- plug-ins/common/sunras.c (revision 22355) +++ plug-ins/common/sunras.c (revision 22356) @@ -102,8 +102,7 @@ gint32 image_ID, gint32 drawable_ID); -static void set_color_table (gint32, L_SUNFILEHEADER *, unsigned char *); - +static void set_color_table (gint32, L_SUNFILEHEADER *, const guchar *); static gint32 create_new_image (const gchar *filename, guint width, guint height, @@ -865,19 +864,20 @@ static void set_color_table (gint32 image_ID, L_SUNFILEHEADER *sunhdr, - guchar *suncolmap) + const guchar *suncolmap) { - int ncols, j; - guchar ColorMap[256*3]; + guchar ColorMap[256 * 3]; + gint ncols, j; ncols = sunhdr->l_ras_maplength / 3; - if (ncols <= 0) return; + if (ncols <= 0) + return; - for (j = 0; j < ncols; j++) + for (j = 0; j < MIN (ncols, 256); j++) { - ColorMap[j*3] = suncolmap[j]; - ColorMap[j*3+1] = suncolmap[j+ncols]; - ColorMap[j*3+2] = suncolmap[j+2*ncols]; + ColorMap[j * 3 + 0] = suncolmap[j]; + ColorMap[j * 3 + 1] = suncolmap[j + ncols]; + ColorMap[j * 3 + 2] = suncolmap[j + 2 * ncols]; } #ifdef DEBUG @@ -886,6 +886,7 @@ printf ("%3d: 0x%02x 0x%02x 0x%02x\n", j, ColorMap[j*3], ColorMap[j*3+1], ColorMap[j*3+2]); #endif + gimp_image_set_colormap (image_ID, ColorMap, ncols); } ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org
participants (1)
-
root@Hilbert.suse.de