commit 57aedabfa3bc555e4d68ad916c757354d518b421
Author: Nils Philippsen <nils@redhat.com>
Date:   Tue Nov 17 11:52:25 2009 +0100

    patch: bmp-hardening
    
    Squashed commit of the following:
    
    commit d7ee36732bc37f4412c82f98473288fde2f6f151
    Author: Nils Philippsen <nils@redhat.com>
    Date:   Mon Nov 16 18:16:38 2009 +0100
    
        Ensure valid bit depths when reading BMP files.
        (cherry picked from commit 16e6a37687bb4b9748c5a5d166d90f5d5bd2e9f3)
        (cherry picked from commit 153ae579f7e7508d7a5b95bd569e91890f6b666e)
    
        Signed-off-by: Nils Philippsen <nils@redhat.com>
    
    commit b76b8400dfffd99826fe73dee81d76029b808689
    Author: Nils Philippsen <nils@redhat.com>
    Date:   Mon Nov 16 17:16:09 2009 +0100
    
        Use more defensive coding in plausibility check.
    
        Use an equivalent division instead of multiplying values and checking if
        they are more than G_MAXINT32, because divisions cannot overflow.
        (cherry picked from commit f63ba36dd9cc01ca6da83fa05ddd12419ad8953e)
        (cherry picked from commit 6e8ff603a2ee6a0940373723d1f075930dfd3ce0)
    
        Signed-off-by: Nils Philippsen <nils@redhat.com>
    
    commit c8bd5c99decca02158f9c0218b33fa057bfdf5ce
    Author: Nils Philippsen <nils@redhat.com>
    Date:   Mon Nov 16 17:15:32 2009 +0100
    
        Make plausibility check easier to understand.
    
        Explicitly check that Bitmap_Head.biHeight is not G_MININT32
        instead of relying on ABS(G_MININT32) being negative.
        (cherry picked from commit 43d57c666346320436a0b668de5525387952784e)
        (cherry picked from commit 0214e1ff271a5310731de81d00450a92d9bf0fcd)
    
        Signed-off-by: Nils Philippsen <nils@redhat.com>
    
    commit eec97e14def220b1de45dcece0a63eb9925f701f
    Author: Simon Budig <simon@gimp.org>
    Date:   Tue Nov 10 00:08:59 2009 +0100
    
        Harden the BMP plugin against integer overflows.
    
        Issues discovered by Stefan Cornelius, Secunia Research, advisory SA37232
        and CVE identifier CVE-2009-1570. Fixes bug #600484.
        (cherry picked from commit df2b0aca2e7cdb95ebfd3454c65aaba0a83e9bbe)
    
        Signed-off-by: Nils Philippsen <nils@redhat.com>

diff --git a/plug-ins/file-bmp/bmp-read.c b/plug-ins/file-bmp/bmp-read.c
index a1ebe47..7ac4cc4 100644
--- a/plug-ins/file-bmp/bmp-read.c
+++ b/plug-ins/file-bmp/bmp-read.c
@@ -400,9 +400,26 @@ ReadBMP (const gchar  *name,
         }
     }
 
-  /* Valid bitpdepthis 1, 4, 8, 16, 24, 32 */
+  /* Valid bit depth is 1, 4, 8, 16, 24, 32 */
   /* 16 is awful, we should probably shoot whoever invented it */
 
+  switch (Bitmap_Head.biBitCnt)
+    {
+    case 1:
+    case 2:
+    case 4:
+    case 8:
+    case 16:
+    case 24:
+    case 32:
+      break;
+    default:
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("'%s' is not a valid BMP file"),
+                   gimp_filename_to_utf8 (filename));
+      return -1;
+    }
+
   /* There should be some colors used! */
 
   ColormapSize =
@@ -424,7 +441,10 @@ ReadBMP (const gchar  *name,
       return -1;
     }
 
-  if (Bitmap_Head.biWidth < 0)
+  /* biHeight may be negative, but G_MININT32 is dangerous because:
+     G_MININT32 == -(G_MININT32) */
+  if (Bitmap_Head.biWidth < 0 ||
+      Bitmap_Head.biHeight == G_MININT32)
     {
       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
                    _("'%s' is not a valid BMP file"),
@@ -448,6 +468,18 @@ ReadBMP (const gchar  *name,
       return -1;
     }
 
+  /* protect against integer overflows caused by malicious BMPs */
+  /* use divisions in comparisons to avoid type overflows */
+
+  if (((guint64) Bitmap_Head.biWidth) > G_MAXINT32 / Bitmap_Head.biBitCnt ||
+      ((guint64) Bitmap_Head.biWidth) > (G_MAXINT32 / ABS (Bitmap_Head.biHeight)) / 4)
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("'%s' is not a valid BMP file"),
+                   gimp_filename_to_utf8 (filename));
+      return -1;
+    }
+
   /* Windows and OS/2 declare filler so that rows are a multiple of
    * word length (32 bits == 4 bytes)
    */