Re: CVE-2012-1149 Is there a patch?

On Wed, 2012-05-23 at 15:24 +0100, Michael Meeks wrote:
>       Off the top of my head this was:
>
> From 93947e85ae1434940aaad516edb60f259b15e950 Mon Sep 17 00:00:00 2001

yeah, the recommended set of patches covered by CVE-2012-1149 is

fe40da4cb640819d869d1c925869bc87ede9bbfe 
88e0fa4aa3bea9ffeee372b6a428ca62cee41203 
9ff94ae0fa947c5fd6a31fbc38421f60eb5e1fba

Attached is my backport to RHEL-5 OOo, which is 3.1.1 or something like
that. Most likely the attached will apply cleanly for you against 3.2.1
without the hassle of all the changed types and whitespace etc inbetween

C.

diff -ru OOO310_m19/basebmp/source/bitmapdevice.cxx OOO310_m19/basebmp/source/bitmapdevice.cxx
--- OOO310_m19/basebmp/source/bitmapdevice.cxx  2012-05-15 15:55:58.214156464 +0100
+++ OOO310_m19/basebmp/source/bitmapdevice.cxx  2012-05-15 16:15:07.292187024 +0100
@@ -1838,8 +1838,16 @@
     // factor in bottom-up scanline order case
     nScanlineStride *= bTopDown ? 1 : -1;
 
-    const std::size_t nMemSize( 
-        (nScanlineStride < 0 ? -nScanlineStride : nScanlineStride)*rSize.getY() );
+    const sal_uInt32 nWidth(nScanlineStride < 0 ? -nScanlineStride : nScanlineStride);
+    const sal_uInt32 nHeight(rSize.getY());
+
+    if (nHeight && nWidth && nWidth > SAL_MAX_INT32 / nHeight)
+    {
+        //suspicious massive alloc
+        return BitmapDeviceSharedPtr();
+    }
+
+    const std::size_t nMemSize(nWidth * nHeight);
 
     if( !pMem )
     {
diff -ru OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx 
OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx
--- OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx  2012-05-15 15:55:57.571148587 +0100
+++ OOO310_m19/svtools/source/filter.vcl/jpeg/jpeg.cxx  2012-05-15 16:08:32.869391259 +0100
@@ -344,17 +344,26 @@
 
 // ------------------------------------------------------------------------
 
-void* JPEGReader::CreateBitmap( void* pParam )
+void* JPEGReader::CreateBitmap( void* _pParam )
 {
-    Size        aSize( ((JPEGCreateBitmapParam*)pParam)->nWidth,
-                        ((JPEGCreateBitmapParam*)pParam)->nHeight );
-    sal_Bool    bGray = ((JPEGCreateBitmapParam*)pParam)->bGray != 0;
+    JPEGCreateBitmapParam *pParam = (JPEGCreateBitmapParam *) _pParam;
+
+    if (pParam->nWidth > SAL_MAX_INT32/8 || pParam->nHeight > SAL_MAX_INT32/8)
+        return NULL; // avoid overflows later
+
+    Size        aSize( pParam->nWidth, pParam->nHeight );
+    sal_Bool    bGray = pParam->bGray != 0;
 
        void* pBmpBuf = NULL;
 
        if( pAcc )
                aBmp.ReleaseAccess( pAcc );
 
+    sal_uInt64 nSize = aSize.Width();
+    nSize *= aSize.Height();
+    if (nSize > SAL_MAX_INT32 / 24)
+        return NULL;
+
        if( bGray )
        {
                BitmapPalette aGrayPal( 256 );
@@ -375,12 +384,11 @@
         unsigned long nUnit = ((JPEGCreateBitmapParam*)pParam)->density_unit;
         
         if( ( ( 1 == nUnit ) || ( 2 == nUnit ) ) && 
-            ( (JPEGCreateBitmapParam*) pParam )->X_density && 
-            ( (JPEGCreateBitmapParam*) pParam )->Y_density )
+            pParam->X_density && pParam->Y_density )
         {
             Point       aEmptyPoint;
-               Fraction        aFractX( 1, ((JPEGCreateBitmapParam*)pParam)->X_density );
-               Fraction        aFractY( 1, ((JPEGCreateBitmapParam*)pParam)->Y_density );
+            Fraction    aFractX( 1, pParam->X_density );
+            Fraction    aFractY( 1, pParam->Y_density );
                MapMode         aMapMode( nUnit == 1 ? MAP_INCH : MAP_CM, aEmptyPoint, aFractX, 
aFractY );
                Size            aPrefSize = OutputDevice::LogicToLogic( aSize, aMapMode, 
MAP_100TH_MM );
 
@@ -393,8 +401,6 @@
 
        if( pAcc )
        {
-        long nAlignedWidth;
-
                const ULONG nFormat = pAcc->GetScanlineFormat();
 
                if(
@@ -407,16 +413,15 @@
                  )
                {
                        pBmpBuf = pAcc->GetBuffer();
-                       nAlignedWidth = pAcc->GetScanlineSize();
-                       ((JPEGCreateBitmapParam*)pParam)->bTopDown = pAcc->IsTopDown();
+            pParam->nAlignedWidth = pAcc->GetScanlineSize();
+            pParam->bTopDown = pAcc->IsTopDown();
                }
                else
                {
-                       nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
-                       ((JPEGCreateBitmapParam*)pParam)->bTopDown = TRUE;
-                       pBmpBuf = pBuffer = rtl_allocateMemory( nAlignedWidth * aSize.Height() );
+            pParam->nAlignedWidth = AlignedWidth4Bytes( aSize.Width() * ( bGray ? 8 : 24 ) );
+            pParam->bTopDown = sal_True;
+            pBmpBuf = pBuffer = rtl_allocateMemory( pParam->nAlignedWidth * aSize.Height() );
                }
-        ((JPEGCreateBitmapParam*)pParam)->nAlignedWidth = nAlignedWidth;
        }
 
        return pBmpBuf;
diff -ru OOO310_m19/vcl/source/gdi/pngread.cxx OOO310_m19/vcl/source/gdi/pngread.cxx
--- OOO310_m19/vcl/source/gdi/pngread.cxx       2012-05-15 15:56:04.265230586 +0100
+++ OOO310_m19/vcl/source/gdi/pngread.cxx       2012-05-15 16:17:07.435648183 +0100
@@ -202,6 +202,8 @@
        mpScanPrior     ( NULL ),
        mpTransTab              ( NULL ),
        mpColorTable    ( (sal_uInt8*) mpDefaultColorTable ),
+    mnPass ( 0 ),
+    mbPalette( sal_False ),
        mbzCodecInUse   ( sal_False ),
     mbStatus( TRUE),
     mbIDAT( FALSE ),
@@ -304,7 +306,7 @@
             nCRC32 = rtl_crc32( nCRC32, &rChunkData.aData[ 0 ], mnChunkLen );
             maDataIter = rChunkData.aData.begin();
         }
-        sal_uInt32 nCheck;
+        sal_uInt32 nCheck(0);
         mrPNGStream >> nCheck;
         if( nCRC32 != nCheck )
             return false;
@@ -370,14 +372,23 @@
     // reset to the first chunk
     maChunkIter = maChunkSeq.begin();
 
-    // parse the chunks
+    // first chunk must be IDHR
+    if( mbStatus && ReadNextChunk() )
+    {
+        if (mnChunkType == PNGCHUNK_IHDR)
+            mbStatus = ImplReadHeader( rPreviewSizeHint );
+        else
+            mbStatus = false;
+    }
+
+    // parse the remaining chunks
     while( mbStatus && !mbIDAT && ReadNextChunk() )
     {
         switch( mnChunkType )
                {
                        case PNGCHUNK_IHDR :
                        {
-                               mbStatus = ImplReadHeader( rPreviewSizeHint );
+                mbStatus = false; //IHDR should only appear as the first chunk
                        }
                        break;
 
@@ -639,14 +650,6 @@
 
        mnScansize = static_cast< sal_uInt32 >( nScansize64 );
 
-    // TODO: switch between both scanlines instead of copying
-       mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
-    mpScanCurrent = mpInflateInBuf;
-       mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
-
-       if ( !mpInflateInBuf || !mpScanPrior )
-               return FALSE;
-
     // calculate target size from original size and the preview hint
     if( rPreviewSizeHint.Width() || rPreviewSizeHint.Height() )
     {
@@ -681,6 +684,21 @@
     maTargetSize.Width()  = (maOrigSize.Width() + mnPreviewMask) >> mnPreviewShift;
     maTargetSize.Height() = (maOrigSize.Height() + mnPreviewMask) >> mnPreviewShift;
 
+    //round bits up to nearest multiple of 8 and divide by 8 to get num of bytes per pixel
+    int nBytesPerPixel = ((mnTargetDepth + 7) & ~7)/8;
+
+    //stupidly big, forget about it
+    if (maTargetSize.Width() >= SAL_MAX_INT32 / nBytesPerPixel / maTargetSize.Height())
+        return sal_False;
+
+    // TODO: switch between both scanlines instead of copying
+       mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
+    mpScanCurrent = mpInflateInBuf;
+       mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
+
+       if ( !mpInflateInBuf || !mpScanPrior )
+               return FALSE;
+
     mpBmp = new Bitmap( maTargetSize, mnTargetDepth );
     mpAcc = mpBmp->AcquireWriteAccess();
     if( !mpAcc )
@@ -792,14 +810,17 @@
                        {
                                if ( mnChunkLen <= 256 )
                                {
+                                       mbTransparent = true;
                                        mpTransTab = new BYTE [ 256 ];
                                        rtl_fillMemory( mpTransTab, 256, 0xff );
-                                       rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen );
-                                       maDataIter += mnChunkLen;
-                                       mbTransparent = true;
-                                       // need alpha transparency if not on/off masking
-                                       for( int i = 0; i < mnChunkLen; ++i )
-                                          bNeedAlpha |= (mpTransTab[i]!=0x00) && 
(mpTransTab[i]!=0xFF);
+                                       if (mnChunkLen > 0)
+                                       {
+                                           rtl_copyMemory( mpTransTab, &(*maDataIter), mnChunkLen 
);
+                                           maDataIter += mnChunkLen;
+                                           // need alpha transparency if not on/off masking
+                                           for( int i = 0; i < mnChunkLen; ++i )
+                                              bNeedAlpha |= (mpTransTab[i]!=0x00) && 
(mpTransTab[i]!=0xFF);
+                    }
                                }
                        }
                        break;