• Shmuel H's avatar
    Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing... · e82aaa4b
    Shmuel H authored
    ...XCF channel and layer properties
    
    The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION,
    PROP_ACTIVE_CHANNEL saves the current object pointer the @info
    structure. Others like PROP_SELECTION (for channel) and
    PROP_GROUP_ITEM (for layer) will delete the current object and create
    a new object, leaving the pointers in @info invalid (dangling).
    
    Therefore, if a property from the first type will come before the
    second, the result will be an UaF in the last lines of xcf_load_image
    (when it actually using the pointers from @info).
    
    I wasn't able to exploit this bug because that
    g_object_instance->c_class gets cleared by the last g_object_unref and
    GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE.
    
    (cherry picked from commit 6d804bf9)
    e82aaa4b
Name
Last commit
Last update
app Loading commit data...
build Loading commit data...
cursors Loading commit data...
data Loading commit data...
desktop Loading commit data...
devel-docs Loading commit data...
docs Loading commit data...
etc Loading commit data...
libgimp Loading commit data...
libgimpbase Loading commit data...
libgimpcolor Loading commit data...
libgimpconfig Loading commit data...
libgimpmath Loading commit data...
libgimpmodule Loading commit data...
libgimpthumb Loading commit data...
libgimpwidgets Loading commit data...
m4macros Loading commit data...
menus Loading commit data...
modules Loading commit data...
plug-ins Loading commit data...
po Loading commit data...
po-libgimp Loading commit data...
po-plug-ins Loading commit data...
po-python Loading commit data...
po-script-fu Loading commit data...
po-tags Loading commit data...
po-tips Loading commit data...
themes Loading commit data...
tools Loading commit data...
.gitignore Loading commit data...
AUTHORS Loading commit data...
COPYING Loading commit data...
ChangeLog.pre-1-0 Loading commit data...
ChangeLog.pre-1-2 Loading commit data...
ChangeLog.pre-2-0 Loading commit data...
ChangeLog.pre-2-2 Loading commit data...
ChangeLog.pre-2-4 Loading commit data...
ChangeLog.pre-2-6 Loading commit data...
ChangeLog.pre-git Loading commit data...
HACKING Loading commit data...
INSTALL Loading commit data...
LICENSE Loading commit data...
MAINTAINERS Loading commit data...
Makefile.am Loading commit data...
NEWS Loading commit data...
NEWS.pre-2-0 Loading commit data...
NEWS.pre-2-2 Loading commit data...
NEWS.pre-2-4 Loading commit data...
NEWS.pre-2-6 Loading commit data...
NEWS.pre-2-8 Loading commit data...
README Loading commit data...
README.i18n Loading commit data...
acinclude.m4 Loading commit data...
authors.dtd Loading commit data...
authors.xml Loading commit data...
authors.xsl Loading commit data...
autogen.sh Loading commit data...
config.h.win32 Loading commit data...
configure.ac Loading commit data...
gimp-zip.in Loading commit data...
gimp.doap Loading commit data...
gimp.pc.in Loading commit data...
gimpthumb.pc.in Loading commit data...
gimpui.pc.in Loading commit data...