* [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 @ 2016-04-21 3:19 Leo Famulari 2016-04-21 3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari ` (2 more replies) 0 siblings, 3 replies; 5+ messages in thread From: Leo Famulari @ 2016-04-21 3:19 UTC (permalink / raw) To: guix-devel This applies from a patch from imlib2's source code repository. The change fixes an integer overflow on 32-bit machines. The upstream says: Security implications: *) for 32-bit machines: insufficient heap allocation and heap overwrite in many image loaders, with escalation potential to remote code execution; *) for 64-bit machines: it seems, no impact. In the patch file, there are references to imlib2's source repo and the CVE page on Mitre. I tested that feh and scrot still work with this change. Leo Famulari (2): gnu: imlib2: Update to 1.4.8. gnu: imlib2: Fix CVE-2016-4024. gnu-system.am | 1 + gnu/packages/image.scm | 5 ++- gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 +++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/imlib2-CVE-2016-4024.patch -- 2.7.4 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/2] gnu: imlib2: Update to 1.4.8. 2016-04-21 3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari @ 2016-04-21 3:19 ` Leo Famulari 2016-04-21 3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari 2016-04-23 3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver 2 siblings, 0 replies; 5+ messages in thread From: Leo Famulari @ 2016-04-21 3:19 UTC (permalink / raw) To: guix-devel gnu/packages/image.scm (imlib2): Update to 1.4.8. --- gnu/packages/image.scm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index ba7c8c3..91d6af6 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -459,7 +459,7 @@ compose, and analyze GIF images.") (define-public imlib2 (package (name "imlib2") - (version "1.4.7") + (version "1.4.8") (source (origin (method url-fetch) (uri (string-append @@ -467,7 +467,7 @@ compose, and analyze GIF images.") version ".tar.bz2")) (sha256 (base32 - "00a7jbwj10x3jcvxa5rplnkvhv35gv9rb400zy636zdd4g737mrm")))) + "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9")))) (build-system gnu-build-system) (native-inputs `(("pkgconfig" ,pkg-config))) -- 2.7.4 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024. 2016-04-21 3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari 2016-04-21 3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari @ 2016-04-21 3:19 ` Leo Famulari 2016-04-23 3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver 2 siblings, 0 replies; 5+ messages in thread From: Leo Famulari @ 2016-04-21 3:19 UTC (permalink / raw) To: guix-devel * gnu/packages/patches/imlib2-CVE-2016-4024.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/image.scm (imlib2): Use it. --- gnu-system.am | 1 + gnu/packages/image.scm | 3 +- gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 +++++++++++++++++++++++++ 3 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/imlib2-CVE-2016-4024.patch diff --git a/gnu-system.am b/gnu-system.am index d58155a..3cdf5e4 100644 --- a/gnu-system.am +++ b/gnu-system.am @@ -534,6 +534,7 @@ dist_patch_DATA = \ gnu/packages/patches/icu4c-CVE-2015-4760.patch \ gnu/packages/patches/ilmbase-fix-tests.patch \ gnu/packages/patches/imagemagick-test-segv.patch \ + gnu/packages/patches/imlib2-CVE-2016-4024.patch \ gnu/packages/patches/irrlicht-mesa-10.patch \ gnu/packages/patches/jasper-CVE-2007-2721.patch \ gnu/packages/patches/jasper-CVE-2008-3520.patch \ diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 91d6af6..db64ea0 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -467,7 +467,8 @@ compose, and analyze GIF images.") version ".tar.bz2")) (sha256 (base32 - "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9")))) + "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9")) + (patches (search-patches "imlib2-CVE-2016-4024.patch")))) (build-system gnu-build-system) (native-inputs `(("pkgconfig" ,pkg-config))) diff --git a/gnu/packages/patches/imlib2-CVE-2016-4024.patch b/gnu/packages/patches/imlib2-CVE-2016-4024.patch new file mode 100644 index 0000000..c4f1f21 --- /dev/null +++ b/gnu/packages/patches/imlib2-CVE-2016-4024.patch @@ -0,0 +1,52 @@ +Fix CVE-2016-4024 (integer overflow in lib/image.h). + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024 + +Upstream source: +https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227 + +From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001 +From: "Yuriy M. Kaminskiy" <yumkam@gmail.com> +Date: Wed, 6 Apr 2016 03:34:01 +0300 +Subject: Fix integer overflow resulting in insufficient heap allocation + +IMAGE_DIMENSIONS_OK ensures that image width and height are less then +46340, so that maximum number of pixels is ~2**31. + +Unfortunately, there are a lot of code that allocates image data with +something like + + malloc(w * h * sizeof(DATA32)); + +Obviously, on 32-bit machines this results in integer overflow, +insufficient heap allocation, with [massive] out-of-bounds heap +overwrite. +Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to +not exceed ULONG_MAX/sizeof(DATA32). + +Security implications: +*) for 32-bit machines: insufficient heap allocation and heap overwrite +in many image loaders, with escalation potential to remote code +execution; +*) for 64-bit machines: it seems, no impact. +--- + src/lib/image.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/lib/image.h b/src/lib/image.h +index e9eb678..5fae6ed 100644 +--- a/src/lib/image.h ++++ b/src/lib/image.h +@@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file, + + /* The maximum pixmap dimension is 65535. */ + /* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */ +-#define X_MAX_DIM 46340 ++/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */ ++#define X_MAX_DIM 32767 + + #define IMAGE_DIMENSIONS_OK(w, h) \ + ( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) ) +-- +cgit v0.12 + -- 2.7.4 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 2016-04-21 3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari 2016-04-21 3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari 2016-04-21 3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari @ 2016-04-23 3:20 ` Mark H Weaver 2016-04-23 4:01 ` Leo Famulari 2 siblings, 1 reply; 5+ messages in thread From: Mark H Weaver @ 2016-04-23 3:20 UTC (permalink / raw) To: Leo Famulari; +Cc: guix-devel Leo Famulari <leo@famulari.name> writes: > This applies from a patch from imlib2's source code repository. > > The change fixes an integer overflow on 32-bit machines. The upstream > says: > > Security implications: > *) for 32-bit machines: insufficient heap allocation and heap overwrite > in many image loaders, with escalation potential to remote code > execution; > *) for 64-bit machines: it seems, no impact. > > In the patch file, there are references to imlib2's source repo and the > CVE page on Mitre. > > I tested that feh and scrot still work with this change. Looks good to me. Please push. Thanks! Mark ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 2016-04-23 3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver @ 2016-04-23 4:01 ` Leo Famulari 0 siblings, 0 replies; 5+ messages in thread From: Leo Famulari @ 2016-04-23 4:01 UTC (permalink / raw) To: Mark H Weaver; +Cc: guix-devel On Fri, Apr 22, 2016 at 11:20:17PM -0400, Mark H Weaver wrote: > Leo Famulari <leo@famulari.name> writes: > > > This applies from a patch from imlib2's source code repository. > > > > The change fixes an integer overflow on 32-bit machines. The upstream > > says: > > > > Security implications: > > *) for 32-bit machines: insufficient heap allocation and heap overwrite > > in many image loaders, with escalation potential to remote code > > execution; > > *) for 64-bit machines: it seems, no impact. > > > > In the patch file, there are references to imlib2's source repo and the > > CVE page on Mitre. > > > > I tested that feh and scrot still work with this change. > > Looks good to me. Please push. Done as e993fb84 ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-04-23 4:01 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-04-21 3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari 2016-04-21 3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari 2016-04-21 3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari 2016-04-23 3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver 2016-04-23 4:01 ` Leo Famulari
Code repositories for project(s) associated with this public inbox https://git.savannah.gnu.org/cgit/guix.git This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).