gbr/pat: Fix out of boundary read on illegal names

The file formats GBR and PAT contain names which are supposed to be
NUL-terminated within the files. If no such terminating NUL byte
exists, the parsers of GBR and PAT trigger an out of boundary read
during utf-8 conversion.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
Tobias Stoeckmann 2017-10-31 12:11:08 +01:00 committed by Jehan
parent f01fa4541f
commit 4fa0cd4dcf
4 changed files with 4 additions and 4 deletions

View File

@ -248,7 +248,7 @@ gimp_brush_load_brush (GimpContext *context,
return NULL; return NULL;
} }
utf8 = gimp_any_to_utf8 (name, -1, utf8 = gimp_any_to_utf8 (name, bn_size - 1,
_("Invalid UTF-8 string in brush file '%s'."), _("Invalid UTF-8 string in brush file '%s'."),
gimp_file_get_utf8_name (file)); gimp_file_get_utf8_name (file));
g_free (name); g_free (name);

View File

@ -119,7 +119,7 @@ gimp_pattern_load (GimpContext *context,
goto error; goto error;
} }
utf8 = gimp_any_to_utf8 (name, -1, utf8 = gimp_any_to_utf8 (name, bn_size - 1,
_("Invalid UTF-8 string in pattern file '%s'."), _("Invalid UTF-8 string in pattern file '%s'."),
gimp_file_get_utf8_name (file)); gimp_file_get_utf8_name (file));
g_free (name); g_free (name);

View File

@ -474,7 +474,7 @@ load_image (GFile *file,
return -1; return -1;
} }
name = gimp_any_to_utf8 (temp, -1, name = gimp_any_to_utf8 (temp, size - 1,
_("Invalid UTF-8 string in brush file '%s'."), _("Invalid UTF-8 string in brush file '%s'."),
g_file_get_parse_name (file)); g_file_get_parse_name (file));
g_free (temp); g_free (temp);

View File

@ -376,7 +376,7 @@ load_image (GFile *file,
return -1; return -1;
} }
name = gimp_any_to_utf8 (temp, -1, name = gimp_any_to_utf8 (temp, ph.header_size - sizeof (PatternHeader) - 1,
_("Invalid UTF-8 string in pattern file '%s'."), _("Invalid UTF-8 string in pattern file '%s'."),
g_file_get_parse_name (file)); g_file_get_parse_name (file));
g_free (temp); g_free (temp);