From 3d3b1559cb34bc862f145c9880d156f6f2fe7b5f Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sat, 17 Nov 2012 16:22:21 +0100 Subject: [PATCH] ppm-load: CVE-2012-4433: add plausibility checks for header fields "Port" of 4757cdf73d3675478d645a3ec8250ba02168a230 by Nils Philippsen from GEGL 0.2.0 to 0.1.8 --- operations/external/ppm-load.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/operations/external/ppm-load.c b/operations/external/ppm-load.c index 6db6e5a..2d4f0ca 100644 --- a/operations/external/ppm-load.c +++ b/operations/external/ppm-load.c @@ -36,6 +36,7 @@ gegl_chant_file_path (path, _("File"), "", _("Path of file to load.")) #include "gegl-chant.h" #include #include +#include typedef enum { PIXMAP_ASCII = 51, @@ -44,8 +45,8 @@ typedef enum { typedef struct { map_type type; - gint width; - gint height; + glong width; + glong height; gsize numsamples; /* width * height * channels */ gsize bpc; /* bytes per channel */ guchar *data; @@ -82,11 +83,33 @@ ppm_load_read_header(FILE *fp, } /* Get Width and Height */ - img->width = strtol (header,&ptr,0); - img->height = atoi (ptr); + errno = 0; + img->width = strtol (header,&ptr,10); + if (errno) + { + g_warning ("Error reading width: %s", strerror(errno)); + return FALSE; + } + else if (img->width < 0) + { + g_warning ("Error: width is negative"); + return FALSE; + } + + img->height = strtol (ptr,&ptr,10); + if (errno) + { + g_warning ("Error reading height: %s", strerror(errno)); + return FALSE; + } + else if (img->width < 0) + { + g_warning ("Error: height is negative"); + return FALSE; + } retval = fgets (header,MAX_CHARS_IN_ROW,fp); - maxval = strtol (header,&ptr,0); + maxval = strtol (header,&ptr,10); if ((maxval != 255) && (maxval != 65535)) { -- 1.7.12.4