Commit Graph

39520 Commits

Author SHA1 Message Date
Tobias Stoeckmann 4fa0cd4dcf gbr/pat: Fix out of boundary read on illegal names
The file formats GBR and PAT contain names which are supposed to be
NUL-terminated within the files. If no such terminating NUL byte
exists, the parsers of GBR and PAT trigger an out of boundary read
during utf-8 conversion.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
2017-12-21 22:09:54 +01:00
Piotr Drąg f01fa4541f Update Polish translation 2017-12-21 22:04:50 +01:00
Jehan 5b9e277625 app, plug-ins: clean up previous commit by using g_error_set()...
... instead of g_message().
2017-12-21 21:55:04 +01:00
Massimo Valentini 657a754f98 Bug 789610: invalid gbr brush crashing GIMP 2017-12-21 21:50:09 +01:00
Jehan 877e79b935 plug-ins: properly propagate GError.
Some g_message() stay when they are used as debug or warning message
(without actually cancelling load action). But all fatal errors now use
g_set_error().
2017-12-21 21:47:25 +01:00
Jehan 037cc8586b plug-ins: use g_set_error() instead of g_message().
Also simplifies a bit the check for PSP version support.
2017-12-21 20:32:17 +01:00
Alan Mortensen 3ff911d348 Updated Danish translation of gimp-tips 2017-12-21 18:40:25 +01:00
Jehan eb2980683e Bug 790853 - (CVE-2017-17787) heap overread in psp importer.
As any external data, we have to check that strings being read at fixed
length are properly nul-terminated.
2017-12-21 12:49:41 +01:00
Jehan 06d24a79af Bug 790784 - (CVE-2017-17784) heap overread in gbr parser / load_image.
We were assuming the input name was well formed, hence was
nul-terminated. As any data coming from external input, this has to be
thorougly checked.
2017-12-21 12:15:34 +01:00
Jehan 28e95fbeb5 Bug 790849 - (CVE-2017-17789) CVE-2017-17789 Heap buffer overflow...
... in PSP importer.
Check if declared block length is valid (i.e. within the actual file)
before going further.
Consider the file as broken otherwise and fail loading it.
2017-12-20 16:44:20 +01:00
Jehan 3d5732e23e plug-ins: some minor coding style fix.
Just some missing spaces between function name and parenthese which I
came across.
2017-12-20 15:12:10 +01:00
Jehan 8ea316667c plug-ins: TGA 16-bit RGB (without alpha bit) is also valid.
According to some spec on the web, 16-bit RGB is also valid. In this
case, the last bit is simply ignored (at least that's how it is
implemented right now).
2017-12-20 13:28:44 +01:00
Jehan 674b62ad45 Bug 739134 - (CVE-2017-17786) Out of bounds read / heap overflow in...
... TGA importer.

Be more thorough on valid TGA RGB and RGBA images.
In particular current TGA plug-in can import RGBA as 32 bits (8 bits per
channel) and 16 bits (5 bits per color channel and 1 bit for alpha), and
RGB as 15 and 24 bits.
Maybe there exist more variants, but if they do exist, we simply don't
support them yet.

Thanks to Hanno Böck for the report and a first patch attempt.
2017-12-20 13:02:38 +01:00
Alexandre Prokoudine 9d31d4caf5 Technical fix for updated ru.po 2017-12-20 01:04:44 +03:00
Alexandre Prokoudine 0952114df0 Update Russian translation 2017-12-20 00:59:44 +03:00
Ell 1f4b78bc68 app: add missing translation context to dashboard action tooltip 2017-12-19 16:57:28 -05:00
Ell 2315784110 Bug 791741 - Transparent rectangles when image is drawn
Add gimp_display_shell_[un]transform_with_scale(), which are
similar to gimp_display_shell_[un]transform(), however, they
transform the bounding box to/from uniformly-scaled image space,
given the scale factor as a parameter.  These functions are more
accurate than using gimp_display_shell_[un]transform() and applying
the scaling separately, in particular, when the scale matches the
(horizontal or vertical) display scale.

Use these functions in gimp_display_shell_draw_image(), to avoid an
off-by-one error when transforming screen-space chunks to image-
space chunks, which leads to the symptoms described in the bug.

Fix another potential off-by-one error affecting non-uniformly
scaled images, and window scale factors other than 1.
2017-12-19 15:04:51 -05:00
Ell 2c495b3b3d app: argh, remove another unusued member from GimpDashboard 2017-12-19 02:53:38 -05:00
Ell 773e7e4d68 app: remove unused members from GimpDashboard struct 2017-12-19 02:50:19 -05:00
Ell 6c991eeb99 app: a few fixes/cleanup in gimp-dashboard.c 2017-12-19 02:42:21 -05:00
Ell 981e8dcdfe app, menus, icons: add dashboard dockable
The dashboard dockable shows the current GEGL cache and swap sizes,
and their recent history.  It has options to control the update
rate and history duration of the data, and an option to warn (by
raising/blinking the dialog) when the swap size approaches its
limit.
2017-12-18 19:42:23 -05:00
Ell 8f3cb718ef app: add GimpMeter widget
GimpMeter visualizes a set of values that change over time.  It
consists of a gauge, showing the most-recent sampled values, a
history graph, showing a plot of the values over time, and an LED,
which can be used as a boolean indicator for some condition.

GimpMeter is used in the dashboard dockable, added in the next
commit.
2017-12-18 19:42:01 -05:00
Thomas Manni 27512d802b Bug 791512 - make the selection boundary detection the same as 2.8
Replace the GIMP_BOUNDARY_HALF_WAY macro by two others : one for perceptual and
one for linear gamma.

Use the GIMP_BOUNDARY_HALF_WAY_LINEAR to compute channels and floating selection
boundaries.
2017-12-18 21:01:30 +01:00
Alan Mortensen 433ee21c7d Updated Danish translation 2017-12-18 17:59:54 +01:00
Ell a002e07afa Merge branch 'fix-pdb-history'
This fixes the history of pdb/groups/*
2017-12-17 14:21:16 -05:00
Michael Natterer b05cfc6050 pdb: (try 3) move PDB generation and sources to toplevel/pdb
It never belonged inside "tools". Also rename its "pdb" subdirectory
to "groups". This had to happen before 2.10 so cherry-picking between
branches doesn't become a nightmare in the future.
2017-12-17 14:16:08 -05:00
Ell 7109db2bdc Revert until "configure.ac: require GEGL => 0.3.27"
This reverts commits:

3b639b1de2
f4ce55a31a
6dfb2ef5fe
682ab6919e
6c5b1ea6cb

In preperation for next commit.
2017-12-17 14:12:31 -05:00
Michael Natterer 6c5b1ea6cb pdb: (try 2) move PDB generation and sources to toplevel/pdb
It never belonged inside "tools". Also rename its "pdb" subdirectory
to "groups". This had to happen before 2.10 so cherry-picking between
branches doesn't become a nightmare in the future.
2017-12-17 19:12:14 +01:00
Michael Natterer 682ab6919e Revert "pdb: move PDB generation and sources to toplevel/pdb"
This reverts commit 3b639b1de2.
2017-12-17 19:10:59 +01:00
Michael Natterer 6dfb2ef5fe Revert "pdb: git didn't commit the "groups" subdirectory..."
This reverts commit f4ce55a31a.
2017-12-17 19:10:42 +01:00
Michael Natterer f4ce55a31a pdb: git didn't commit the "groups" subdirectory... 2017-12-17 19:03:18 +01:00
Michael Natterer 3b639b1de2 pdb: move PDB generation and sources to toplevel/pdb
It never belonged inside "tools". Also rename its "pdb" subdirectory
to "groups". This had to happen before 2.10 so cherry-picking between
branches doesn't become a nightmare in the future.
2017-12-17 18:41:34 +01:00
Michael Natterer 89a9d0e93e configure.ac: require GEGL => 0.3.27 2017-12-17 18:19:08 +01:00
Jehan 10d80a6ced plug-ins: try to get more human-readable information on why g_fopen()...
... failed.
See bug 791514. It seems that the file opening fails for webp exporting,
but the error string is not informative enough.
As a general rule, we should have as informative errors as possible.
2017-12-17 16:47:00 +01:00
Jehan 5bce92be67 NEWS: add implementation for Freedesktop screenshot API. 2017-12-16 21:57:33 +01:00
Jehan 80490a2c07 plug-ins: add a SCREENSHOT_CAN_SHOOT_WINDOW capability.
And add the relevant option for when such capability is absent. Right
now it is absent only from the new Freedesktop API.
2017-12-16 21:54:49 +01:00
Chao-Hsiung Liao 5289afad14 Update Chinese (Taiwan) translation 2017-12-16 02:33:58 +00:00
Chao-Hsiung Liao 4fc4a8dd8e Update Chinese (Taiwan) translation 2017-12-16 02:31:51 +00:00
Jehan 53a03b38e5 plug-ins: implementation of the Freedesktop portal for screenshot.
I am told by the GNOME/Flatpak people that this is what we will
ultimately need to implement. Basically this portal is supposed to work
everywhere, in sandboxes (Flatpak, hopefully Snap too?), but also out
of sandboxes, i.e. in GNOME and KDE, whether Wayland or X11. So that
should be the unique API we will have to implement in the end, and every
desktop environment/sandbox will need to implement this API (which is
good!).
Apparently it is not part of default GNOME yet, but has to be installed
separately (on Fedora, package is xdg-desktop-portal-gtk for GNOME and
xdg-desktop-portal-kde for KDE).

Now there are currently many shortcomings, and in particular, the
screenshot API has apparently no advanced features (at all!). No window
snap, no rectangular selection, no delaying, no choice on including
cursor or decoration, nothing! Apparently this is normal that the API
presents no feature, because "the API itself is not meant to specify the
details how the screenshot is obtained. Instead the portal will present
the user a dialog to take a screenshot, and that screenshot will be
given back to the sandboxed app".
This is acceptable behavior, except that currently, the dialog has none
of the basic features so this is a very bad regression. This is why I
test the freedesktop API last, which basically means it will likely
never be actually used. That's on purpose. At least, the code is in and
will be easy to improve later. Of course, when the Freedesktop portal
for screenshot will finally be featureful, it is meant to be tested
first.

See: https://github.com/flatpak/xdg-desktop-portal/blob/master/data/org.freedesktop.portal.Screenshot.xml
2017-12-16 02:36:15 +01:00
Jehan 6fee1a413f NEWS: start changes for next release.
I assumed we would switch to RC releases now (cf. IRC discussions). This
can be changed later if we finally decide to do another dev release
instead.
2017-12-14 02:34:52 +01:00
Jehan edb0928e53 build: 2.9.8 dev build must now use a higher lcms2 dep version. 2017-12-14 02:20:41 +01:00
Jehan b9260266ab build: arrrgh! Also the commit for GIMP repo! 2017-12-13 22:57:11 +01:00
Jehan f112fbe734 build: forgot to update the flatpak commit hashes.
Oups!
2017-12-13 22:51:32 +01:00
Jehan 1b8281269b plug-ins: the file-ps plug-in won't take care about PDF import anymore. 2017-12-13 20:35:41 +01:00
Jehan 7d8dd66e85 INSTALL: update dependency information.
It seems we forgot to move librsvg from optional to mandatory
dependency. Also add RawTherapee as an optional runtime dependency.
Finally reorder the lists alphabetically.
2017-12-13 20:30:02 +01:00
Jehan ce894dfd1e configure: MIME_TYPES value only cares about import.
This variable is used for the MimeType key in the desktop file, which
allows to know if a software can open a file with the Exec key command.
Whether GIMP can also export such format is not to be taken into
consideration.
2017-12-13 20:17:14 +01:00
Jehan a207570cfe Bug 791397 - Gimp import multi page PDF only imports first page.
Poppler and poppler-data are now hard dependencies.
PDF is a common-enough format nowadays that import support is likely
considered as a granted feature by everyone. Moreover the current
fallback to the PostScript plug-in for PDF support just gives a degraded
experience with less features (and probably a lot of bugs since
basically nobody uses this code).
Poppler-data is also considered mandatory because non-western language
support should never be considered an "option". People using non-western
languages are not second class citizens and therefore if we say that PDF
import is now a hard feature, it should also include PDF using CJK or
Cyrillic languages.
2017-12-13 20:16:24 +01:00
Jehan c9913bc1e7 NEWS: a/aan rgument/an argument/.
A little late for this small typo, but let's still fix it.
2017-12-13 17:45:42 +01:00
Jehan e922671223 build: update flatpak manifest for the development release.
Even though we don't have an official build yet (flatpak only does
stable builds), let's keep up with the releases. :-)
2017-12-12 23:49:06 +01:00
Michael Natterer e8dd20feda configure.ac: post-release version bump to 2.9.9 2017-12-12 20:54:13 +01:00