callisto-debian/gimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Issue #1719 - GIMP crashes with an invalid pluginrc

Browse Source 
Fix 3 more crashes caused by accepting broken input, spotted by
Massimo.
This commit is contained in:
Michael Natterer
2018-07-04 00:17:24 +02:00
parent 17429c585f
commit 7db59e7af9
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
app/plug-in/plug-in-rc.c
View File

@ -273,6 +273,12 @@ plug_in_def_deserialize (Gimp *gimp,
if (! gimp_scanner_parse_string (scanner, &path)) if (! gimp_scanner_parse_string (scanner, &path))
return G_TOKEN_STRING; return G_TOKEN_STRING;
if (! (path && *path))
{
g_scanner_error (scanner, "plug-in filename is empty");
return G_TOKEN_ERROR;
}
file = gimp_file_new_for_config_path (path, &error); file = gimp_file_new_for_config_path (path, &error);
g_free (path); g_free (path);
@ -383,12 +389,27 @@ plug_in_procedure_deserialize (GScanner *scanner,
if (! gimp_scanner_parse_string (scanner, &str)) if (! gimp_scanner_parse_string (scanner, &str))
return G_TOKEN_STRING; return G_TOKEN_STRING;
if (! (str && *str))
{
g_scanner_error (scanner, "procedure name is empty");
return G_TOKEN_ERROR;
}
if (! gimp_scanner_parse_int (scanner, &proc_type)) if (! gimp_scanner_parse_int (scanner, &proc_type))
{ {
g_free (str); g_free (str);
return G_TOKEN_INT; return G_TOKEN_INT;
} }
if (proc_type != GIMP_PLUGIN &&
proc_type != GIMP_EXTENSION)
{
g_free (str);
g_scanner_error (scanner, "procedure type %d is out of range",
proc_type);
return G_TOKEN_ERROR;
}
procedure = gimp_plug_in_procedure_new (proc_type, file); procedure = gimp_plug_in_procedure_new (proc_type, file);
*proc = GIMP_PLUG_IN_PROCEDURE (procedure); *proc = GIMP_PLUG_IN_PROCEDURE (procedure);