53 lines
1.8 KiB
Diff
53 lines
1.8 KiB
Diff
|
Fix CVE-2016-4024 (integer overflow in lib/image.h).
|
||
|
|
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024
|
||
|
|
|
||
|
|
Upstream source:
|
||
|
|
https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227
|
||
|
|
|
||
|
|
From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001
|
||
|
|
From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
|
||
|
|
Date: Wed, 6 Apr 2016 03:34:01 +0300
|
||
|
|
Subject: Fix integer overflow resulting in insufficient heap allocation
|
||
|
|
|
||
|
|
IMAGE_DIMENSIONS_OK ensures that image width and height are less then
|
||
|
|
46340, so that maximum number of pixels is ~2**31.
|
||
|
|
|
||
|
|
Unfortunately, there are a lot of code that allocates image data with
|
||
|
|
something like
|
||
|
|
|
||
|
|
malloc(w * h * sizeof(DATA32));
|
||
|
|
|
||
|
|
Obviously, on 32-bit machines this results in integer overflow,
|
||
|
|
insufficient heap allocation, with [massive] out-of-bounds heap
|
||
|
|
overwrite.
|
||
|
|
Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to
|
||
|
|
not exceed ULONG_MAX/sizeof(DATA32).
|
||
|
|
|
||
|
|
Security implications:
|
||
|
|
*) for 32-bit machines: insufficient heap allocation and heap overwrite
|
||
|
|
in many image loaders, with escalation potential to remote code
|
||
|
|
execution;
|
||
|
|
*) for 64-bit machines: it seems, no impact.
|
||
|
|
---
|
||
|
|
src/lib/image.h | 3 ++-
|
||
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/src/lib/image.h b/src/lib/image.h
|
||
|
|
index e9eb678..5fae6ed 100644
|
||
|
|
--- a/src/lib/image.h
|
||
|
|
+++ b/src/lib/image.h
|
||
|
|
@@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file,
|
||
|
|
|
||
|
|
/* The maximum pixmap dimension is 65535. */
|
||
|
|
/* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
|
||
|
|
-#define X_MAX_DIM 46340
|
||
|
|
+/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */
|
||
|
|
+#define X_MAX_DIM 32767
|
||
|
|
|
||
|
|
#define IMAGE_DIMENSIONS_OK(w, h) \
|
||
|
|
( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) )
|
||
|
|
--
|
||
|
|
cgit v0.12
|
||
|
|
|