CVE-2023-34634 (published 2023-08-01T14:15Z)

Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/greenshot/greenshot
commit_details: repo_url: https://github.com/greenshot/greenshot
author: Robin Krom
author_date: 2023-03-27 21:51:01+02:00
msg: This should improve the backwards compatibility for the .greenshot file from earlier versions. This was also addressed in #375
repository: repo_url: https://github.com/greenshot/greenshot
repo_name: greenshot/greenshot
description: Greenshot for Windows - Report bugs & features go here: https://greenshot.atlassian.net or look for information on:
repo_language: C#
owner: greenshot
file_changes: filename: FreehandContainer.cs
change_type: ModificationType.MODIFY
diff: @@ -1,323 +1,325 @@
-﻿/*
- * Greenshot - a free and open source screenshot tool
- * Copyright (C) 2007-2021 Thomas Braun, Jens Klingen, Robin Krom
- * 
- * For more information see: https://getgreenshot.org/
- * The Greenshot project is hosted on GitHub https://github.com/greenshot/greenshot
- * 
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 1 of the License, or
- * (at your option) any later version.
- * 
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- * 
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-using System;
-using System.Collections.Generic;
-using System.Drawing;
-using System.Drawing.Drawing2D;
-using System.Runtime.Serialization;
-using Dapplo.Windows.Common.Structs;
-using Greenshot.Base.Interfaces;
-using Greenshot.Base.Interfaces.Drawing;
-using Greenshot.Editor.Drawing.Fields;
-using Greenshot.Editor.Helpers;
-
-namespace Greenshot.Editor.Drawing
-{
-    /// <summary>
-    /// Description of PathContainer.
-    /// </summary>
-    [Serializable]
-    public class FreehandContainer : DrawableContainer
-    {
-        private static readonly float[] PointOffset =
-        {
-            0.5f, 0.25f, 0.75f
-        };
-
-        [NonSerialized] private GraphicsPath freehandPath = new GraphicsPath();
-        private NativeRect myBounds = NativeRect.Empty;
-        private NativePoint lastMouse = NativePoint.Empty;
-        private readonly List<Point> capturePoints = new List<Point>();
-        private bool isRecalculated;
-
-        /// <summary>
-        /// Constructor
-        /// </summary>
-        public FreehandContainer(ISurface parent) : base(parent)
-        {
-            Width = parent.Image.Width;
-            Height = parent.Image.Height;
-            Top = 0;
-            Left = 0;
-        }
-
-        protected override void InitializeFields()
-        {
-            AddField(GetType(), FieldType.LINE_THICKNESS, 3);
-            AddField(GetType(), FieldType.LINE_COLOR, Color.Red);
-        }
-
-        public override void Transform(Matrix matrix)
-        {
-            Point[] points = capturePoints.ToArray();
-
-            matrix.TransformPoints(points);
-            capturePoints.Clear();
-            capturePoints.AddRange(points);
-            RecalculatePath();
-        }
-
-        protected override void OnDeserialized(StreamingContext context)
-        {
-            RecalculatePath();
-        }
-
-        /// <summary>
-        /// This Dispose is called from the Dispose and the Destructor.
-        /// </summary>
-        /// <param name="disposing">When disposing==true all non-managed resources should be freed too!</param>
-        protected override void Dispose(bool disposing)
-        {
-            base.Dispose(disposing);
-            if (disposing)
-            {
-                freehandPath?.Dispose();
-            }
-
-            freehandPath = null;
-        }
-
-        /// <summary>
-        /// Called from Surface (the parent) when the drawing begins (mouse-down)
-        /// </summary>
-        /// <returns>true if the surface doesn't need to handle the event</returns>
-        public override bool HandleMouseDown(int mouseX, int mouseY)
-        {
-            lastMouse = new Point(mouseX, mouseY);
-            capturePoints.Add(lastMouse);
-            return true;
-        }
-
-        /// <summary>
-        /// Called from Surface (the parent) if a mouse move is made while drawing
-        /// </summary>
-        /// <returns>true if the surface doesn't need to handle the event</returns>
-        public override bool HandleMouseMove(int mouseX, int mouseY)
-        {
-            Point previousPoint = capturePoints[capturePoints.Count - 1];
-
-            if (GeometryHelper.Distance2D(previousPoint.X, previousPoint.Y, mouseX, mouseY) >= 2 * EditorConfig.FreehandSensitivity)
-            {
-                capturePoints.Add(new Point(mouseX, mouseY));
-            }
-
-            if (GeometryHelper.Distance2D(lastMouse.X, lastMouse.Y, mouseX, mouseY) < EditorConfig.FreehandSensitivity)
-            {
-                return true;
-            }
-
-            //path.AddCurve(new Point[]{lastMouse, new Point(mouseX, mouseY)});
-            lastMouse = new Point(mouseX, mouseY);
-            freehandPath.AddLine(lastMouse, new Point(mouseX, mouseY));
-            // Only re-calculate the bounds & redraw when we added something to the path
-            myBounds = Rectangle.Round(freehandPath.GetBounds());
-
-            Invalidate();
-            return true;
-        }
-
-        /// <summary>
-        /// Called when the surface finishes drawing the element
-        /// </summary>
-        public override void HandleMouseUp(int mouseX, int mouseY)
-        {
-            // Make sure we don't loose the ending point
-            if (GeometryHelper.Distance2D(lastMouse.X, lastMouse.Y, mouseX, mouseY) >= EditorConfig.FreehandSensitivity)
-            {
-                capturePoints.Add(new Point(mouseX, mouseY));
-            }
-
-            RecalculatePath();
-        }
-
-        /// <summary>
-        /// Here we recalculate the freehand path by smoothing out the lines with Beziers.
-        /// </summary>
-        private void RecalculatePath()
-        {
-            // Store the previous path, to dispose it later when we are finished
-            var previousFreehandPath = freehandPath;
-            var newFreehandPath = new GraphicsPath();
-
-            // Here we can put some cleanup... like losing all the uninteresting  points.
-            if (capturePoints.Count >= 3)
-            {
-                int index = 0;
-                while ((capturePoints.Count - 1) % 3 != 0)
-                {
-                    // duplicate points, first at 50% than 25% than 75%
-                    capturePoints.Insert((int) (capturePoints.Count * PointOffset[index]), capturePoints[(int) (capturePoints.Count * PointOffset[index++])]);
-                }
-
-                newFreehandPath.AddBeziers(capturePoints.ToArray());
-            }
-            else if (capturePoints.Count == 2)
-            {
-                newFreehandPath.AddLine(capturePoints[0], capturePoints[1]);
-            }
-
-            // Recalculate the bounds
-            myBounds = Rectangle.Round(newFreehandPath.GetBounds());
-
-            // assign
-            isRecalculated = true;
-            freehandPath = newFreehandPath;
-
-            // dispose previous
-            previousFreehandPath?.Dispose();
-        }
-
-        /// <summary>
-        /// Do the drawing of the freehand "stroke"
-        /// </summary>
-        /// <param name="graphics"></param>
-        /// <param name="renderMode"></param>
-        public override void Draw(Graphics graphics, RenderMode renderMode)
-        {
-            graphics.SmoothingMode = SmoothingMode.HighQuality;
-            graphics.InterpolationMode = InterpolationMode.HighQualityBicubic;
-            graphics.CompositingQuality = CompositingQuality.HighQuality;
-            graphics.PixelOffsetMode = PixelOffsetMode.HighQuality;
-
-            int lineThickness = GetFieldValueAsInt(FieldType.LINE_THICKNESS);
-            Color lineColor = GetFieldValueAsColor(FieldType.LINE_COLOR);
-            using var pen = new Pen(lineColor)
-            {
-                Width = lineThickness
-            };
-            if (!(pen.Width > 0))
-            {
-                return;
-            }
-
-            // Make sure the lines are nicely rounded
-            pen.EndCap = LineCap.Round;
-            pen.StartCap = LineCap.Round;
-            pen.LineJoin = LineJoin.Round;
-            // Move to where we need to draw
-            graphics.TranslateTransform(Left, Top);
-            var currentFreehandPath = freehandPath;
-            if (currentFreehandPath != null)
-            {
-                if (isRecalculated && Selected && renderMode == RenderMode.EDIT)
-                {
-                    isRecalculated = false;
-                    DrawSelectionBorder(graphics, pen, currentFreehandPath);
-                }
-
-                graphics.DrawPath(pen, currentFreehandPath);
-            }
-
-            // Move back, otherwise everything is shifted
-            graphics.TranslateTransform(-Left, -Top);
-        }
-
-        /// <summary>
-        /// Draw a selectionborder around the freehand path
-        /// </summary>
-        /// <param name="graphics">Graphics</param>
-        /// <param name="linePen">Pen</param>
-        /// <param name="path">GraphicsPath</param>
-        protected static void DrawSelectionBorder(Graphics graphics, Pen linePen, GraphicsPath path)
-        {
-            using var selectionPen = (Pen) linePen.Clone();
-            using var selectionPath = (GraphicsPath) path.Clone();
-            selectionPen.Width += 5;
-            selectionPen.Color = Color.FromArgb(120, Color.LightSeaGreen);
-            graphics.DrawPath(selectionPen, selectionPath);
-            selectionPath.Widen(selectionPen);
-            selectionPen.DashPattern = new float[]
-            {
-                2, 2
-            };
-            selectionPen.Color = Color.LightSeaGreen;
-            selectionPen.Width = 1;
-            graphics.DrawPath(selectionPen, selectionPath);
-        }
-
-        /// <summary>
-        /// Get the bounds in which we have something drawn, plus safety margin, these are not the normal bounds...
-        /// </summary>
-        public override NativeRect DrawingBounds
-        {
-            get
-            {
-                if (!myBounds.IsEmpty)
-                {
-                    int lineThickness = Math.Max(10, GetFieldValueAsInt(FieldType.LINE_THICKNESS));
-                    int safetyMargin = 10;
-                    return new NativeRect(myBounds.Left + Left - (safetyMargin + lineThickness), myBounds.Top + Top - (safetyMargin + lineThickness),
-                        myBounds.Width + 2 * (lineThickness + safetyMargin), myBounds.Height + 2 * (lineThickness + safetyMargin));
-                }
-
-                if (_parent?.Image is Image image)
-                {
-                    return new NativeRect(0, 0, image.Width, image.Height);
-                }
-
-                return NativeRect.Empty;
-            }
-        }
-
-        /// <summary>
-        /// FreehandContainer are regarded equal if they are of the same type and their paths are equal.
-        /// </summary>
-        /// <param name="obj">object</param>
-        /// <returns>bool</returns>
-        public override bool Equals(object obj)
-        {
-            bool ret = false;
-            if (obj == null || GetType() != obj.GetType())
-            {
-                return false;
-            }
-
-            if (obj is FreehandContainer other && Equals(freehandPath, other.freehandPath))
-            {
-                ret = true;
-            }
-
-            return ret;
-        }
-
-        public override int GetHashCode()
-        {
-            return freehandPath?.GetHashCode() ?? 0;
-        }
-
-        public override bool ClickableAt(int x, int y)
-        {
-            bool returnValue = base.ClickableAt(x, y);
-            if (returnValue)
-            {
-                int lineThickness = GetFieldValueAsInt(FieldType.LINE_THICKNESS);
-                using var pen = new Pen(Color.White)
-                {
-                    Width = lineThickness + 10
-                };
-                returnValue = freehandPath.IsOutlineVisible(x - Left, y - Top, pen);
-            }
-
-            return returnValue;
-        }
-    }
+﻿/*
+ * Greenshot - a free and open source screenshot tool
+ * Copyright (C) 2007-2021 Thomas Braun, Jens Klingen, Robin Krom
+ * 
+ * For more information see: https://getgreenshot.org/
+ * The Greenshot project is hosted on GitHub https://github.com/greenshot/greenshot
+ * 
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 1 of the License, or
+ * (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Drawing;
+using System.Drawing.Drawing2D;
+using System.Runtime.Serialization;
+using Dapplo.Windows.Common.Structs;
+using Greenshot.Base.Interfaces;
+using Greenshot.Base.Interfaces.Drawing;
+using Greenshot.Editor.Drawing.Fields;
+using Greenshot.Editor.Helpers;
+
+namespace Greenshot.Editor.Drawing
+{
+    /// <summary>
+    /// Description of PathContainer.
+    /// </summary>
+    [Serializable]
+    public class FreehandContainer : DrawableContainer
+    {
+        private static readonly float[] PointOffset =
+        {
+            0.5f, 0.25f, 0.75f
+        };
+
+        [NonSerialized]
+        private GraphicsPath freehandPath = new GraphicsPath();
+
+        private Rectangle myBounds = NativeRect.Empty;
+        private Point lastMouse = NativePoint.Empty;
+        private List<Point> capturePoints = new List<Point>();
+        private bool isRecalculated;
+
+        /// <summary>
+        /// Constructor
+        /// </summary>
+        public FreehandContainer(ISurface parent) : base(parent)
+        {
+            Width = parent.Image.Width;
+            Height = parent.Image.Height;
+            Top = 0;
+            Left = 0;
+        }
+
+        protected override void InitializeFields()
+        {
+            AddField(GetType(), FieldType.LINE_THICKNESS, 3);
+            AddField(GetType(), FieldType.LINE_COLOR, Color.Red);
+        }
+
+        public override void Transform(Matrix matrix)
+        {
+            Point[] points = capturePoints.ToArray();
+
+            matrix.TransformPoints(points);
+            capturePoints.Clear();
+            capturePoints.AddRange(points);
+            RecalculatePath();
+        }
+
+        protected override void OnDeserialized(StreamingContext context)
+        {
+            RecalculatePath();
+        }
+
+        /// <summary>
+        /// This Dispose is called from the Dispose and the Destructor.
+        /// </summary>
+        /// <param name="disposing">When disposing==true all non-managed resources should be freed too!</param>
+        protected override void Dispose(bool disposing)
+        {
+            base.Dispose(disposing);
+            if (disposing)
+            {
+                freehandPath?.Dispose();
+            }
+
+            freehandPath = null;
+        }
+
+        /// <summary>
+        /// Called from Surface (the parent) when the drawing begins (mouse-down)
+        /// </summary>
+        /// <returns>true if the surface doesn't need to handle the event</returns>
+        public override bool HandleMouseDown(int mouseX, int mouseY)
+        {
+            lastMouse = new Point(mouseX, mouseY);
+            capturePoints.Add(lastMouse);
+            return true;
+        }
+
+        /// <summary>
+        /// Called from Surface (the parent) if a mouse move is made while drawing
+        /// </summary>
+        /// <returns>true if the surface doesn't need to handle the event</returns>
+        public override bool HandleMouseMove(int mouseX, int mouseY)
+        {
+            Point previousPoint = capturePoints[capturePoints.Count - 1];
+
+            if (GeometryHelper.Distance2D(previousPoint.X, previousPoint.Y, mouseX, mouseY) >= 2 * EditorConfig.FreehandSensitivity)
+            {
+                capturePoints.Add(new Point(mouseX, mouseY));
+            }
+
+            if (GeometryHelper.Distance2D(lastMouse.X, lastMouse.Y, mouseX, mouseY) < EditorConfig.FreehandSensitivity)
+            {
+                return true;
+            }
+
+            //path.AddCurve(new Point[]{lastMouse, new Point(mouseX, mouseY)});
+            lastMouse = new Point(mouseX, mouseY);
+            freehandPath.AddLine(lastMouse, new Point(mouseX, mouseY));
+            // Only re-calculate the bounds & redraw when we added something to the path
+            myBounds = Rectangle.Round(freehandPath.GetBounds());
+
+            Invalidate();
+            return true;
+        }
+
+        /// <summary>
+        /// Called when the surface finishes drawing the element
+        /// </summary>
+        public override void HandleMouseUp(int mouseX, int mouseY)
+        {
+            // Make sure we don't loose the ending point
+            if (GeometryHelper.Distance2D(lastMouse.X, lastMouse.Y, mouseX, mouseY) >= EditorConfig.FreehandSensitivity)
+            {
+                capturePoints.Add(new Point(mouseX, mouseY));
+            }
+
+            RecalculatePath();
+        }
+
+        /// <summary>
+        /// Here we recalculate the freehand path by smoothing out the lines with Beziers.
+        /// </summary>
+        private void RecalculatePath()
+        {
+            // Store the previous path, to dispose it later when we are finished
+            var previousFreehandPath = freehandPath;
+            var newFreehandPath = new GraphicsPath();
+
+            // Here we can put some cleanup... like losing all the uninteresting  points.
+            if (capturePoints.Count >= 3)
+            {
+                int index = 0;
+                while ((capturePoints.Count - 1) % 3 != 0)
+                {
+                    // duplicate points, first at 50% than 25% than 75%
+                    capturePoints.Insert((int) (capturePoints.Count * PointOffset[index]), capturePoints[(int) (capturePoints.Count * PointOffset[index++])]);
+                }
+
+                newFreehandPath.AddBeziers(capturePoints.ToArray());
+            }
+            else if (capturePoints.Count == 2)
+            {
+                newFreehandPath.AddLine(capturePoints[0], capturePoints[1]);
+            }
+
+            // Recalculate the bounds
+            myBounds = Rectangle.Round(newFreehandPath.GetBounds());
+
+            // assign
+            isRecalculated = true;
+            freehandPath = newFreehandPath;
+
+            // dispose previous
+            previousFreehandPath?.Dispose();
+        }
+
+        /// <summary>
+        /// Do the drawing of the freehand "stroke"
+        /// </summary>
+        /// <param name="graphics"></param>
+        /// <param name="renderMode"></param>
+        public override void Draw(Graphics graphics, RenderMode renderMode)
+        {
+            graphics.SmoothingMode = SmoothingMode.HighQuality;
+            graphics.InterpolationMode = InterpolationMode.HighQualityBicubic;
+            graphics.CompositingQuality = CompositingQuality.HighQuality;
+            graphics.PixelOffsetMode = PixelOffsetMode.HighQuality;
+
+            int lineThickness = GetFieldValueAsInt(FieldType.LINE_THICKNESS);
+            Color lineColor = GetFieldValueAsColor(FieldType.LINE_COLOR);
+            using var pen = new Pen(lineColor)
+            {
+                Width = lineThickness
+            };
+            if (!(pen.Width > 0))
+            {
+                return;
+            }
+
+            // Make sure the lines are nicely rounded
+            pen.EndCap = LineCap.Round;
+            pen.StartCap = LineCap.Round;
+            pen.LineJoin = LineJoin.Round;
+            // Move to where we need to draw
+            graphics.TranslateTransform(Left, Top);
+            var currentFreehandPath = freehandPath;
+            if (currentFreehandPath != null)
+            {
+                if (isRecalculated && Selected && renderMode == RenderMode.EDIT)
+                {
+                    isRecalculated = false;
+                    DrawSelectionBorder(graphics, pen, currentFreehandPath);
+                }
+
+                graphics.DrawPath(pen, currentFreehandPath);
+            }
+
+            // Move back, otherwise everything is shifted
+            graphics.TranslateTransform(-Left, -Top);
+        }
+
+        /// <summary>
+        /// Draw a selectionborder around the freehand path
+        /// </summary>
+        /// <param name="graphics">Graphics</param>
+        /// <param name="linePen">Pen</param>
+        /// <param name="path">GraphicsPath</param>
+        protected static void DrawSelectionBorder(Graphics graphics, Pen linePen, GraphicsPath path)
+        {
+            using var selectionPen = (Pen) linePen.Clone();
+            using var selectionPath = (GraphicsPath) path.Clone();
+            selectionPen.Width += 5;
+            selectionPen.Color = Color.FromArgb(120, Color.LightSeaGreen);
+            graphics.DrawPath(selectionPen, selectionPath);
+            selectionPath.Widen(selectionPen);
+            selectionPen.DashPattern = new float[]
+            {
+                2, 2
+            };
+            selectionPen.Color = Color.LightSeaGreen;
+            selectionPen.Width = 1;
+            graphics.DrawPath(selectionPen, selectionPath);
+        }
+
+        /// <summary>
+        /// Get the bounds in which we have something drawn, plus safety margin, these are not the normal bounds...
+        /// </summary>
+        public override NativeRect DrawingBounds
+        {
+            get
+            {
+                if (!myBounds.IsEmpty)
+                {
+                    int lineThickness = Math.Max(10, GetFieldValueAsInt(FieldType.LINE_THICKNESS));
+                    int safetyMargin = 10;
+                    return new NativeRect(myBounds.Left + Left - (safetyMargin + lineThickness), myBounds.Top + Top - (safetyMargin + lineThickness),
+                        myBounds.Width + 2 * (lineThickness + safetyMargin), myBounds.Height + 2 * (lineThickness + safetyMargin));
+                }
+
+                if (_parent?.Image is Image image)
+                {
+                    return new NativeRect(0, 0, image.Width, image.Height);
+                }
+
+                return NativeRect.Empty;
+            }
+        }
+
+        /// <summary>
+        /// FreehandContainer are regarded equal if they are of the same type and their paths are equal.
+        /// </summary>
+        /// <param name="obj">object</param>
+        /// <returns>bool</returns>
+        public override bool Equals(object obj)
+        {
+            bool ret = false;
+            if (obj == null || GetType() != obj.GetType())
+            {
+                return false;
+            }
+
+            if (obj is FreehandContainer other && Equals(freehandPath, other.freehandPath))
+            {
+                ret = true;
+            }
+
+            return ret;
+        }
+
+        public override int GetHashCode()
+        {
+            return freehandPath?.GetHashCode() ?? 0;
+        }
+
+        public override bool ClickableAt(int x, int y)
+        {
+            bool returnValue = base.ClickableAt(x, y);
+            if (returnValue)
+            {
+                int lineThickness = GetFieldValueAsInt(FieldType.LINE_THICKNESS);
+                using var pen = new Pen(Color.White)
+                {
+                    Width = lineThickness + 10
+                };
+                returnValue = freehandPath.IsOutlineVisible(x - Left, y - Top, pen);
+            }
+
+            return returnValue;
+        }
+   }
 }
\ No newline at end of file

programming_language: C#
filename: SpeechbubbleContainer.cs
change_type: ModificationType.MODIFY
diff: @@ -39,10 +39,10 @@ namespace Greenshot.Editor.Drawing
     [Serializable]
     public class SpeechbubbleContainer : TextContainer
     {
-        private NativePoint _initialGripperPoint;
+        private Point _initialGripperPoint;
 
         // Only used for serializing the TargetGripper location
-        private NativePoint _storedTargetGripperLocation;
+        private Point _storedTargetGripperLocation;
 
         /// <summary>
         /// Store the current location of the target gripper
@@ -120,7 +120,8 @@ namespace Greenshot.Editor.Drawing
             int xOffset = leftAligned ? -20 : 20;
             int yOffset = topAligned ? -20 : 20;
 
-            NativePoint newGripperLocation = _initialGripperPoint.Offset(xOffset, yOffset);
+            NativePoint initialGripperPoint = _initialGripperPoint;
+            NativePoint newGripperLocation = initialGripperPoint.Offset(xOffset, yOffset);
 
             if (TargetAdorner.Location != newGripperLocation)
             {

programming_language: C#
filename: Surface.cs
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,7 @@ using System.Drawing.Imaging;
 using System.IO;
 using System.Linq;
 using System.Runtime.Serialization.Formatters.Binary;
+using System.ServiceModel.Security;
 using System.Windows.Forms;
 using Dapplo.Windows.Common.Extensions;
 using Dapplo.Windows.Common.Structs;
@@ -40,6 +41,7 @@ using Greenshot.Base.Interfaces.Drawing;
 using Greenshot.Base.Interfaces.Drawing.Adorners;
 using Greenshot.Editor.Configuration;
 using Greenshot.Editor.Drawing.Fields;
+using Greenshot.Editor.Helpers;
 using Greenshot.Editor.Memento;
 using log4net;
 
@@ -722,6 +724,7 @@ namespace Greenshot.Editor.Drawing
             try
             {
                 BinaryFormatter binaryRead = new BinaryFormatter();
+                binaryRead.Binder = new BinaryFormatterHelper();
                 IDrawableContainerList loadedElements = (IDrawableContainerList) binaryRead.Deserialize(streamRead);
                 loadedElements.Parent = this;
                 // Make sure the steplabels are sorted according to their number
@@ -731,6 +734,10 @@ namespace Greenshot.Editor.Drawing
                 SelectElements(loadedElements);
                 FieldAggregator.BindElements(loadedElements);
             }
+            catch (SecurityAccessDeniedException)
+            {
+                throw;
+            }
             catch (Exception e)
             {
                 LOG.Error("Error serializing elements from stream.", e);

programming_language: C#
filename: BinaryFormatterHelper.cs
change_type: ModificationType.ADD
diff: @@ -0,0 +1,111 @@
+﻿/*
+ * Greenshot - a free and open source screenshot tool
+ * Copyright (C) 2007-2021 Thomas Braun, Jens Klingen, Robin Krom
+ * 
+ * For more information see: https://getgreenshot.org/
+ * The Greenshot project is hosted on GitHub https://github.com/greenshot/greenshot
+ * 
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 1 of the License, or
+ * (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.Runtime.Serialization;
+using System.ServiceModel.Security;
+using Greenshot.Base.Interfaces.Drawing;
+using Greenshot.Editor.Drawing;
+using Greenshot.Editor.Drawing.Fields;
+using Greenshot.Editor.Drawing.Filters;
+using log4net;
+using static Greenshot.Editor.Drawing.FilterContainer;
+
+namespace Greenshot.Editor.Helpers
+{
+    internal class BinaryFormatterHelper : SerializationBinder
+    {
+        private static readonly ILog LOG = LogManager.GetLogger(typeof(BinaryFormatterHelper));
+        private static readonly IDictionary<string, Type> TypeMapper = new Dictionary<string, Type>
+        {
+            {"System.Guid",typeof(Guid) },
+            {"System.Drawing.Rectangle",typeof(System.Drawing.Rectangle) },
+            {"System.Drawing.Point",typeof(System.Drawing.Point) },
+            {"System.Drawing.Color",typeof(System.Drawing.Color) },
+            {"System.Drawing.Bitmap",typeof(System.Drawing.Bitmap) },
+            {"System.Drawing.StringAlignment",typeof(System.Drawing.StringAlignment) },
+            {"System.Collections.Generic.List`1[[Greenshot.Base.Interfaces.Drawing.IFieldHolder", typeof(List<IFieldHolder>)},
+            {"System.Collections.Generic.List`1[[Greenshot.Base.Interfaces.Drawing.IField", typeof(List<IField>)},
+            {"System.Collections.Generic.List`1[[System.Drawing.Point", typeof(List<System.Drawing.Point>)},
+            {"Greenshot.Editor.Drawing.ArrowContainer", typeof(ArrowContainer) },
+            {"Greenshot.Editor.Drawing.LineContainer", typeof(LineContainer) },
+            {"Greenshot.Editor.Drawing.TextContainer", typeof(TextContainer) },
+            {"Greenshot.Editor.Drawing.SpeechbubbleContainer", typeof(SpeechbubbleContainer) },
+            {"Greenshot.Editor.Drawing.RectangleContainer", typeof(RectangleContainer) },
+            {"Greenshot.Editor.Drawing.EllipseContainer", typeof(EllipseContainer) },
+            {"Greenshot.Editor.Drawing.FreehandContainer", typeof(FreehandContainer) },
+            {"Greenshot.Editor.Drawing.HighlightContainer", typeof(HighlightContainer) },
+            {"Greenshot.Editor.Drawing.IconContainer", typeof(IconContainer) },
+            {"Greenshot.Editor.Drawing.ObfuscateContainer", typeof(ObfuscateContainer) },
+            {"Greenshot.Editor.Drawing.StepLabelContainer", typeof(StepLabelContainer) },
+            {"Greenshot.Editor.Drawing.SvgContainer", typeof(SvgContainer) },
+            {"Greenshot.Editor.Drawing.VectorGraphicsContainer", typeof(VectorGraphicsContainer) },
+            {"Greenshot.Editor.Drawing.MetafileContainer", typeof(MetafileContainer) },
+            {"Greenshot.Editor.Drawing.ImageContainer", typeof(ImageContainer) },
+            {"Greenshot.Editor.Drawing.FilterContainer", typeof(FilterContainer) },
+            {"Greenshot.Editor.Drawing.DrawableContainer", typeof(DrawableContainer) },
+            {"Greenshot.Editor.Drawing.DrawableContainerList", typeof(DrawableContainerList) },
+            {"Greenshot.Editor.Drawing.CursorContainer", typeof(CursorContainer) },
+            {"Greenshot.Editor.Drawing.Filters.HighlightFilter", typeof(HighlightFilter) },
+            {"Greenshot.Editor.Drawing.Filters.GrayscaleFilter", typeof(GrayscaleFilter) },
+            {"Greenshot.Editor.Drawing.Filters.MagnifierFilter", typeof(MagnifierFilter) },
+            {"Greenshot.Editor.Drawing.Filters.BrightnessFilter", typeof(BrightnessFilter) },
+            {"Greenshot.Editor.Drawing.Filters.BlurFilter", typeof(BlurFilter) },
+            {"Greenshot.Editor.Drawing.Filters.PixelizationFilter", typeof(PixelizationFilter) },
+            {"Greenshot.Base.Interfaces.Drawing.IDrawableContainer", typeof(IDrawableContainer) },
+            {"Greenshot.Base.Interfaces.Drawing.EditStatus", typeof(EditStatus) },
+            {"Greenshot.Base.Interfaces.Drawing.IFieldHolder", typeof(IFieldHolder) },
+            {"Greenshot.Base.Interfaces.Drawing.IField", typeof(IField) },
+            {"Greenshot.Base.Interfaces.Drawing.FieldFlag", typeof(FieldFlag) },
+            {"Greenshot.Editor.Drawing.Fields.Field", typeof(Field) },
+            {"Greenshot.Editor.Drawing.Fields.FieldType", typeof(FieldType) },
+            {"Greenshot.Editor.Drawing.FilterContainer+PreparedFilter", typeof(PreparedFilter) },
+        };
+        // Greenshot.Plugin.Drawing.EditStatus -> Greenshot.Base.Interfaces.Drawing.EditStatus
+        // GreenshotPlugin.Interfaces.Drawing.IFieldHolder -> Greenshot.Base.Interfaces.Drawing.IFieldHolder
+        // Greenshot.Drawing.FilterContainer+PreparedFilter -> Greenshot.Editor.Drawing
+        public override Type BindToType(string assemblyName, string typeName)
+        {
+            if (string.IsNullOrEmpty(typeName))
+            {
+                return null;
+            }
+            var typeNameCommaLocation = typeName.IndexOf(",");
+            var comparingTypeName = typeName.Substring(0, typeNameCommaLocation > 0 ? typeNameCommaLocation : typeName.Length);
+
+            // Correct wrong types
+            comparingTypeName = comparingTypeName.Replace("Greenshot.Drawing", "Greenshot.Editor.Drawing");
+            comparingTypeName = comparingTypeName.Replace("Greenshot.Plugin.Drawing", "Greenshot.Base.Interfaces.Drawing");
+            comparingTypeName = comparingTypeName.Replace("GreenshotPlugin.Interfaces.Drawing", "Greenshot.Base.Interfaces.Drawing");
+            comparingTypeName = comparingTypeName.Replace("Greenshot.Drawing.Fields", "Greenshot.Editor.Drawing.Fields");
+            comparingTypeName = comparingTypeName.Replace("Greenshot.Drawing.Filters", "Greenshot.Editor.Drawing.Filters");
+
+            if (TypeMapper.TryGetValue(comparingTypeName, out var returnType))
+            {
+                LOG.Info($"Mapped {assemblyName} - {typeName} to {returnType.FullName}");
+                return returnType;
+            }
+            LOG.Warn($"Unexpected Greenshot type in .greenshot file detected, maybe vulnerability attack created with ysoserial? Suspicious type: {assemblyName} - {typeName}");
+            throw new SecurityAccessDeniedException($"Suspicious type in .greenshot file: {assemblyName} - {typeName}");
+        }
+    }
+}

programming_language: C#