[gimp/gimp-2-10] Issue #1719 - GIMP crashes with an invalid pluginrc



commit d70bf7653dd6695e3cff088264502b0c2de2a2bf
Author: Michael Natterer <mitch gimp org>
Date:   Wed Jul 4 00:17:24 2018 +0200

    Issue #1719 - GIMP crashes with an invalid pluginrc
    
    Fix 3 more crashes caused by accepting broken input, spotted by
    Massimo.
    
    (cherry picked from commit 7db59e7af93f690f954ebde16af8d52ccde583c4)

 app/plug-in/plug-in-rc.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
---
diff --git a/app/plug-in/plug-in-rc.c b/app/plug-in/plug-in-rc.c
index 411d997191..1cd95a4719 100644
--- a/app/plug-in/plug-in-rc.c
+++ b/app/plug-in/plug-in-rc.c
@@ -273,6 +273,12 @@ plug_in_def_deserialize (Gimp      *gimp,
   if (! gimp_scanner_parse_string (scanner, &path))
     return G_TOKEN_STRING;
 
+  if (! (path && *path))
+    {
+      g_scanner_error (scanner, "plug-in filename is empty");
+      return G_TOKEN_ERROR;
+    }
+
   file = gimp_file_new_for_config_path (path, &error);
   g_free (path);
 
@@ -383,12 +389,27 @@ plug_in_procedure_deserialize (GScanner             *scanner,
   if (! gimp_scanner_parse_string (scanner, &str))
     return G_TOKEN_STRING;
 
+  if (! (str && *str))
+    {
+      g_scanner_error (scanner, "procedure name is empty");
+      return G_TOKEN_ERROR;
+    }
+
   if (! gimp_scanner_parse_int (scanner, &proc_type))
     {
       g_free (str);
       return G_TOKEN_INT;
     }
 
+  if (proc_type != GIMP_PLUGIN &&
+      proc_type != GIMP_EXTENSION)
+    {
+      g_free (str);
+      g_scanner_error (scanner, "procedure type %d is out of range",
+                       proc_type);
+      return G_TOKEN_ERROR;
+    }
+
   procedure = gimp_plug_in_procedure_new (proc_type, file);
 
   *proc = GIMP_PLUG_IN_PROCEDURE (procedure);


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]