diff --git a/0001-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch b/0001-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch new file mode 100644 index 0000000000000000000000000000000000000000..3d6a75d3b7dd754545195dde17e22b788d0ec8d8 --- /dev/null +++ b/0001-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch @@ -0,0 +1,130 @@ +From 4550fc1bfacd36e4d9c6f375b366c2e88885af46 Mon Sep 17 00:00:00 2001 +From: Jehan +Date: Tue, 24 Dec 2019 01:22:13 +0100 +Subject: [PATCH 1/2] Issue #4392: Gimp Segmentation Fault triggered by Glib + GParamSpec... + +... property name validation. +GLib tightened its GParamSpec name validation, as it used to only check +that the first letter was a letter, which triggered this issue, though +the crash could have also happened with the former lax rules too (commit +30e630c9df792cf36cdb1cceb3daefbde1dc898a). + +I opened a merge request in GLib to make the validation code into a +public function. In the meantime, let's just copy-paste the validation +code into ours and when a plug-in attempts to create a procedure with +invalid parameter or return value names, GIMP will just output an error +and refuse to install the procedure instead of crashing. +See: https://gitlab.gnome.org/GNOME/glib/merge_requests/1302 +--- + app/plug-in/gimpplugin-message.c | 77 +++++++++++++++++++++++++++----- + 1 file changed, 67 insertions(+), 10 deletions(-) + +diff --git a/app/plug-in/gimpplugin-message.c b/app/plug-in/gimpplugin-message.c +index fd2abcd904..a397f83adb 100644 +--- a/app/plug-in/gimpplugin-message.c ++++ b/app/plug-in/gimpplugin-message.c +@@ -76,6 +76,7 @@ static void gimp_plug_in_handle_proc_uninstall (GimpPlugIn *plug_in, + static void gimp_plug_in_handle_extension_ack (GimpPlugIn *plug_in); + static void gimp_plug_in_handle_has_init (GimpPlugIn *plug_in); + ++static gboolean gimp_plug_in_is_valid_property_name (const gchar *name); + + /* public functions */ + +@@ -861,22 +862,48 @@ gimp_plug_in_handle_proc_install (GimpPlugIn *plug_in, + + for (i = 0; i < proc_install->nparams; i++) + { +- GParamSpec *pspec = +- gimp_pdb_compat_param_spec (plug_in->manager->gimp, +- proc_install->params[i].type, +- proc_install->params[i].name, +- proc_install->params[i].description); ++ GParamSpec *pspec; ++ ++ if (! gimp_plug_in_is_valid_property_name (proc_install->params[i].name)) ++ { ++ gimp_message (plug_in->manager->gimp, NULL, GIMP_MESSAGE_ERROR, ++ "Plug-in \"%s\"\n(%s)\n" ++ "attempted to install procedure \"%s\" with " ++ "invalid parameter name \"%s\".", ++ gimp_object_get_name (plug_in), ++ gimp_file_get_utf8_name (plug_in->file), ++ canonical, proc_install->params[i].name); ++ g_object_unref (procedure); ++ return; ++ } ++ pspec = gimp_pdb_compat_param_spec (plug_in->manager->gimp, ++ proc_install->params[i].type, ++ proc_install->params[i].name, ++ proc_install->params[i].description); + + gimp_procedure_add_argument (procedure, pspec); + } + + for (i = 0; i < proc_install->nreturn_vals; i++) + { +- GParamSpec *pspec = +- gimp_pdb_compat_param_spec (plug_in->manager->gimp, +- proc_install->return_vals[i].type, +- proc_install->return_vals[i].name, +- proc_install->return_vals[i].description); ++ GParamSpec *pspec; ++ ++ if (! gimp_plug_in_is_valid_property_name (proc_install->return_vals[i].name)) ++ { ++ gimp_message (plug_in->manager->gimp, NULL, GIMP_MESSAGE_ERROR, ++ "Plug-in \"%s\"\n(%s)\n" ++ "attempted to install procedure \"%s\" with " ++ "invalid return value name \"%s\".", ++ gimp_object_get_name (plug_in), ++ gimp_file_get_utf8_name (plug_in->file), ++ canonical, proc_install->return_vals[i].name); ++ g_object_unref (procedure); ++ return; ++ } ++ pspec = gimp_pdb_compat_param_spec (plug_in->manager->gimp, ++ proc_install->return_vals[i].type, ++ proc_install->return_vals[i].name, ++ proc_install->return_vals[i].description); + + gimp_procedure_add_return_value (procedure, pspec); + } +@@ -979,3 +1006,33 @@ gimp_plug_in_handle_has_init (GimpPlugIn *plug_in) + gimp_plug_in_close (plug_in, TRUE); + } + } ++ ++/* ++ * XXX: this function should be removed when/if it becomes public in ++ * glib, i.e. when this patch is merged: ++ * https://gitlab.gnome.org/GNOME/glib/merge_requests/1302 ++ * See #4392. ++ */ ++static gboolean ++gimp_plug_in_is_valid_property_name (const gchar *name) ++{ ++ const gchar *p; ++ ++ /* First character must be a letter. */ ++ if ((name[0] < 'A' || name[0] > 'Z') && ++ (name[0] < 'a' || name[0] > 'z')) ++ return FALSE; ++ ++ for (p = name; *p != 0; p++) ++ { ++ const gchar c = *p; ++ ++ if (c != '-' && c != '_' && ++ (c < '0' || c > '9') && ++ (c < 'A' || c > 'Z') && ++ (c < 'a' || c > 'z')) ++ return FALSE; ++ } ++ ++ return TRUE; ++} +-- +2.27.0 + diff --git a/0002-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch b/0002-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch new file mode 100644 index 0000000000000000000000000000000000000000..75e6c90e10301fb8bcdd143aabb2dfb05754560d --- /dev/null +++ b/0002-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch @@ -0,0 +1,29 @@ +From 573c043babce0620db715afa7696e5b06d7a0a3e Mon Sep 17 00:00:00 2001 +From: Jehan +Date: Tue, 24 Dec 2019 01:32:57 +0100 +Subject: [PATCH 2/2] Issue #4392: Gimp Segmentation Fault triggered by Glib + GParamSpec... + +... property name validation. +Previous commit fixed the parameter name validation in core code. This +commit fixes the source error in the plug-in code. +--- + plug-ins/pagecurl/pagecurl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plug-ins/pagecurl/pagecurl.c b/plug-ins/pagecurl/pagecurl.c +index 048395ef83..c82dc8ab5e 100644 +--- a/plug-ins/pagecurl/pagecurl.c ++++ b/plug-ins/pagecurl/pagecurl.c +@@ -195,7 +195,7 @@ query (void) + + static const GimpParamDef return_vals[] = + { +- { GIMP_PDB_LAYER, "Curl Layer", "The new layer with the curl." } ++ { GIMP_PDB_LAYER, "curl-layer", "The new layer with the curl." } + }; + + gimp_install_procedure (PLUG_IN_PROC, +-- +2.27.0 + diff --git a/gimp.spec b/gimp.spec index 1b9988521ea2b7e56ed9e7dec9055330a3912bd4..5b6f7ef5a2e3def5054ea72fd03af212cef7c538 100644 --- a/gimp.spec +++ b/gimp.spec @@ -1,12 +1,14 @@ Name: gimp Version: 2.10.6 -Release: 9 +Release: 10 Epoch: 2 Summary: A versatile graphics manipulation package License: GPLv3+ and GPLv3 URL: http://www.gimp.org/ Source0: http://download.gimp.org/pub/gimp/v2.10/gimp-2.10.6.tar.bz2 +Patch10: 0001-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch +Patch11: 0002-Issue-4392-Gimp-Segmentation-Fault-triggered-by-Glib.patch Patch6000: backport-CVE-2018-12713.patch Patch6001: CVE-2021-45463.patch @@ -255,6 +257,12 @@ make check %{?_smp_mflags} %{_mandir}/man*/* %changelog +* Mon Apr 25 2022 6peng <6peng@proton.me> - 2:2.10.6-10 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC: fix Gimp-Segmentation-Fault-triggered-by-Glib + * Fri Jan 07 2022 yaoxin - 2:2.10.6-9 - Fix CVE-2021-45463