From 66ceac29afde903c013ec6ade2b12f2b5b6e4050 Mon Sep 17 00:00:00 2001 From: Nils Philippsen Date: Mon, 23 May 2011 16:40:05 +0200 Subject: [PATCH] patch: CVE-2010-4540,4541,4542 Squashed commit of the following: commit c63c02e87b9c399f60a6a8d6d235f22a470fe2d2 Author: Simon Budig Date: Tue Jan 11 23:28:16 2011 +0100 fixes for some buffer overflow problems (see bug #639203) (cherry picked from commit 7fb0300e1cfdb98a3bde54dbc73a0f3eda375162) --- plug-ins/common/sphere-designer.c | 5 ++++- plug-ins/gfig/gfig-style.c | 8 +++++++- plug-ins/lighting/lighting-ui.c | 27 +++++++++++++++++++++++---- 3 files changed, 34 insertions(+), 6 deletions(-) diff --git a/plug-ins/common/sphere-designer.c b/plug-ins/common/sphere-designer.c index 5421067..b06af40 100644 --- a/plug-ins/common/sphere-designer.c +++ b/plug-ins/common/sphere-designer.c @@ -1992,6 +1992,7 @@ loadit (const gchar * fn) gchar endbuf[21 * (G_ASCII_DTOSTR_BUF_SIZE + 1)]; gchar *end = endbuf; gchar line[1024]; + gchar fmt_str[16]; gint i; texture *t; gint majtype, type; @@ -2016,6 +2017,8 @@ loadit (const gchar * fn) s.com.numtexture = 0; + snprintf (fmt_str, sizeof (fmt_str), "%%d %%d %%%lds", sizeof (endbuf) - 1); + while (!feof (f)) { @@ -2026,7 +2029,7 @@ loadit (const gchar * fn) t = &s.com.texture[i]; setdefaults (t); - if (sscanf (line, "%d %d %s", &t->majtype, &t->type, end) != 3) + if (sscanf (line, fmt_str, &t->majtype, &t->type, end) != 3) t->color1.x = g_ascii_strtod (end, &end); if (end && errno != ERANGE) t->color1.y = g_ascii_strtod (end, &end); diff --git a/plug-ins/gfig/gfig-style.c b/plug-ins/gfig/gfig-style.c index f8fefb8..685fe58 100644 --- a/plug-ins/gfig/gfig-style.c +++ b/plug-ins/gfig/gfig-style.c @@ -165,6 +165,7 @@ gfig_read_parameter_gimp_rgb (gchar **text, gchar *ptr; gchar *tmpstr; gchar *endptr; + gchar fmt_str[32]; gchar colorstr_r[G_ASCII_DTOSTR_BUF_SIZE]; gchar colorstr_g[G_ASCII_DTOSTR_BUF_SIZE]; gchar colorstr_b[G_ASCII_DTOSTR_BUF_SIZE]; @@ -172,6 +173,10 @@ gfig_read_parameter_gimp_rgb (gchar **text, style_entry->r = style_entry->g = style_entry->b = style_entry->a = 0.; + snprintf (fmt_str, sizeof (fmt_str), "%%%lds %%%lds %%%lds %%%lds", + sizeof (colorstr_r) - 1, sizeof (colorstr_g) - 1, + sizeof (colorstr_b) - 1, sizeof (colorstr_a) - 1); + while (n < nitems) { ptr = strchr (text[n], ':'); @@ -181,7 +186,8 @@ gfig_read_parameter_gimp_rgb (gchar **text, ptr++; if (!strcmp (tmpstr, name)) { - sscanf (ptr, "%s %s %s %s", colorstr_r, colorstr_g, colorstr_b, colorstr_a); + sscanf (ptr, fmt_str, + colorstr_r, colorstr_g, colorstr_b, colorstr_a); style_entry->r = g_ascii_strtod (colorstr_r, &endptr); style_entry->g = g_ascii_strtod (colorstr_g, &endptr); style_entry->b = g_ascii_strtod (colorstr_b, &endptr); diff --git a/plug-ins/lighting/lighting-ui.c b/plug-ins/lighting/lighting-ui.c index 71cd58f..702cda9 100644 --- a/plug-ins/lighting/lighting-ui.c +++ b/plug-ins/lighting/lighting-ui.c @@ -1342,6 +1342,7 @@ load_preset_response (GtkFileChooser *chooser, gchar buffer3[G_ASCII_DTOSTR_BUF_SIZE]; gchar type_label[21]; gchar *endptr; + gchar fmt_str[32]; if (response_id == GTK_RESPONSE_OK) { @@ -1381,23 +1382,41 @@ load_preset_response (GtkFileChooser *chooser, return; } - fscanf (fp, " Position: %s %s %s", buffer1, buffer2, buffer3); + snprintf (fmt_str, sizeof (fmt_str), + " Position: %%%lds %%%lds %%%lds", + sizeof (buffer1) - 1, + sizeof (buffer2) - 1, + sizeof (buffer3) - 1); + fscanf (fp, fmt_str, buffer1, buffer2, buffer3); source->position.x = g_ascii_strtod (buffer1, &endptr); source->position.y = g_ascii_strtod (buffer2, &endptr); source->position.z = g_ascii_strtod (buffer3, &endptr); - fscanf (fp, " Direction: %s %s %s", buffer1, buffer2, buffer3); + snprintf (fmt_str, sizeof (fmt_str), + " Direction: %%%lds %%%lds %%%lds", + sizeof (buffer1) - 1, + sizeof (buffer2) - 1, + sizeof (buffer3) - 1); + fscanf (fp, fmt_str, buffer1, buffer2, buffer3); source->direction.x = g_ascii_strtod (buffer1, &endptr); source->direction.y = g_ascii_strtod (buffer2, &endptr); source->direction.z = g_ascii_strtod (buffer3, &endptr); - fscanf (fp, " Color: %s %s %s", buffer1, buffer2, buffer3); + snprintf (fmt_str, sizeof (fmt_str), + " Color: %%%lds %%%lds %%%lds", + sizeof (buffer1) - 1, + sizeof (buffer2) - 1, + sizeof (buffer3) - 1); + fscanf (fp, fmt_str, buffer1, buffer2, buffer3); source->color.r = g_ascii_strtod (buffer1, &endptr); source->color.g = g_ascii_strtod (buffer2, &endptr); source->color.b = g_ascii_strtod (buffer3, &endptr); source->color.a = 1.0; - fscanf (fp, " Intensity: %s", buffer1); + snprintf (fmt_str, sizeof (fmt_str), + " Intensity: %%%lds", + sizeof (buffer1) - 1); + fscanf (fp, fmt_str, buffer1); source->intensity = g_ascii_strtod (buffer1, &endptr); } -- 1.7.5.1