full-disclosure - Re: ScriptFu Server Buffer Overflow in GIMP <= 2.6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20120701024800.6587114DBD8@smtp.hushmail.com>
Date: Sat, 30 Jun 2012 21:48:00 -0500
From: mancha@....hush.com
To: full-disclosure@...ts.grok.org.uk
Subject: Re: ScriptFu Server Buffer Overflow in GIMP <= 2.6

Below find a patch for the 2.6.x branch of GIMP to address a potential
buffer overflow in the script-fu server (CVE-2012-2763) reported on this list
by J. Sheridan (http://seclists.org/fulldisclosure/2012/May/318)

 --mancha

======================

Fix for CVE-2012-2763 for GIMP 2.6.x by mancha. Based on commit
76155d79df8d497. Thanks to muks, Kevin, and Ankh for identifying the
relevant code change.

Ref: Fixed potential buffer overflow in readstr_upto().

----------

--- a/plug-ins/script-fu/tinyscheme/scheme.c            2012-06-30
+++ b/plug-ins/script-fu/tinyscheme/scheme.c            2012-06-30
@@ -1727,7 +1727,8 @@ static char *readstr_upto(scheme *sc, ch
     c = inchar(sc);
     len = g_unichar_to_utf8(c, p);
     p += len;
-  } while (c && !is_one_of(delim, c));
+  } while ((p - sc->strbuff < sizeof(sc->strbuff)) &&
+          (c && !is_one_of(delim, c)));

   if(p==sc->strbuff+2 && c_prev=='\\')
     *p = '\0';

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/