diff --git a/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch new file mode 100644 index 0000000000..d28cb1e848 --- /dev/null +++ b/meta-gnome/recipes-gimp/gimp/gimp/CVE-2023-44441.patch @@ -0,0 +1,61 @@ +From babb323270a37091604bec44ee3597150cac8227 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 1 Oct 2023 17:54:08 +0000 +Subject: [PATCH] plug-ins: Fix DDS vulnerability (ZDI-CAN-22093) + +Resolves #10069 + +Currently, the DDS header information for the width, height, and bytes per scan line +are read in and assumed to be correct. As these values are used for memory allocation +and reading, it would be good to verify they do not exceed the file size. + +This patch adds a condition after the header is read in to verify those values. If they exceed +the file size (mins an offset), the file is not read in and an error message is shown. + +CVE: CVE-2023-44441 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gimp/-/commit/7db71cd0b6e36c454aa0d2d3efeec7e636db4dbc] +Signed-off-by: Gyorgy Sarvari +--- + plug-ins/file-dds/ddsread.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c +index a8eb8b8..98e122d 100644 +--- a/plug-ins/file-dds/ddsread.c ++++ b/plug-ins/file-dds/ddsread.c +@@ -109,6 +109,7 @@ read_dds (gchar *filename, + guchar *pixels; + gchar *tmp; + FILE *fp; ++ gsize file_size; + dds_header_t hdr; + dds_header_dx10_t dx10hdr; + dds_load_info_t d; +@@ -130,6 +131,10 @@ read_dds (gchar *filename, + return GIMP_PDB_EXECUTION_ERROR; + } + ++ fseek (fp, 0L, SEEK_END); ++ file_size = ftell (fp); ++ fseek (fp, 0, SEEK_SET); ++ + if (strrchr (filename, '/')) + tmp = g_strdup_printf ("Loading %s:", strrchr (filename, '/') + 1); + else +@@ -186,6 +191,16 @@ read_dds (gchar *filename, + } + } + ++ /* verify header information is accurate */ ++ if (hdr.depth < 1 || ++ (hdr.pitch_or_linsize > (file_size - sizeof (hdr))) || ++ (((guint64) hdr.height * hdr.width * hdr.depth) > (file_size - sizeof (hdr)))) ++ { ++ fclose (fp); ++ g_message ("Invalid or corrupted DDS header\n"); ++ return GIMP_PDB_EXECUTION_ERROR; ++ } ++ + if (hdr.pixelfmt.flags & DDPF_FOURCC) + { + /* fourcc is dXt* or rXgb */ diff --git a/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb b/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb index f312dde399..11b369a42e 100644 --- a/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb +++ b/meta-gnome/recipes-gimp/gimp/gimp_2.10.30.bb @@ -48,6 +48,7 @@ SRC_URI = "https://download.gimp.org/pub/${BPN}/v${SHPV}/${BP}.tar.bz2 \ file://CVE-2022-32990-1.patch \ file://CVE-2022-32990-2.patch \ file://CVE-2022-32990-3.patch \ + file://CVE-2023-44441.patch \ " SRC_URI[sha256sum] = "88815daa76ed7d4277eeb353358bafa116cd2fcd2c861d95b95135c1d52b67dc"