all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024
@ 2016-04-21  3:19 Leo Famulari
  2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Leo Famulari @ 2016-04-21  3:19 UTC (permalink / raw)
  To: guix-devel

This applies from a patch from imlib2's source code repository.

The change fixes an integer overflow on 32-bit machines. The upstream
says:

Security implications:
*) for 32-bit machines: insufficient heap allocation and heap overwrite
in many image loaders, with escalation potential to remote code
execution;
*) for 64-bit machines: it seems, no impact.

In the patch file, there are references to imlib2's source repo and the
CVE page on Mitre.

I tested that feh and scrot still work with this change.

Leo Famulari (2):
  gnu: imlib2: Update to 1.4.8.
  gnu: imlib2: Fix CVE-2016-4024.

 gnu-system.am                                   |  1 +
 gnu/packages/image.scm                          |  5 ++-
 gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 +++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100644 gnu/packages/patches/imlib2-CVE-2016-4024.patch

-- 
2.7.4

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH 1/2] gnu: imlib2: Update to 1.4.8.
  2016-04-21  3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari
@ 2016-04-21  3:19 ` Leo Famulari
  2016-04-21  3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari
  2016-04-23  3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver
  2 siblings, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2016-04-21  3:19 UTC (permalink / raw)
  To: guix-devel

gnu/packages/image.scm (imlib2): Update to 1.4.8.
---
 gnu/packages/image.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index ba7c8c3..91d6af6 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -459,7 +459,7 @@ compose, and analyze GIF images.")
 (define-public imlib2
   (package
     (name "imlib2")
-    (version "1.4.7")
+    (version "1.4.8")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -467,7 +467,7 @@ compose, and analyze GIF images.")
                     version ".tar.bz2"))
               (sha256
                (base32
-                "00a7jbwj10x3jcvxa5rplnkvhv35gv9rb400zy636zdd4g737mrm"))))
+                "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkgconfig" ,pkg-config)))
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024.
  2016-04-21  3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari
  2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
@ 2016-04-21  3:19 ` Leo Famulari
  2016-04-23  3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver
  2 siblings, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2016-04-21  3:19 UTC (permalink / raw)
  To: guix-devel

* gnu/packages/patches/imlib2-CVE-2016-4024.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/image.scm (imlib2): Use it.
---
 gnu-system.am                                   |  1 +
 gnu/packages/image.scm                          |  3 +-
 gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 +++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/imlib2-CVE-2016-4024.patch

diff --git a/gnu-system.am b/gnu-system.am
index d58155a..3cdf5e4 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -534,6 +534,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/icu4c-CVE-2015-4760.patch		\
   gnu/packages/patches/ilmbase-fix-tests.patch			\
   gnu/packages/patches/imagemagick-test-segv.patch		\
+  gnu/packages/patches/imlib2-CVE-2016-4024.patch		\
   gnu/packages/patches/irrlicht-mesa-10.patch			\
   gnu/packages/patches/jasper-CVE-2007-2721.patch		\
   gnu/packages/patches/jasper-CVE-2008-3520.patch		\
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 91d6af6..db64ea0 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -467,7 +467,8 @@ compose, and analyze GIF images.")
                     version ".tar.bz2"))
               (sha256
                (base32
-                "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9"))))
+                "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9"))
+              (patches (search-patches "imlib2-CVE-2016-4024.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkgconfig" ,pkg-config)))
diff --git a/gnu/packages/patches/imlib2-CVE-2016-4024.patch b/gnu/packages/patches/imlib2-CVE-2016-4024.patch
new file mode 100644
index 0000000..c4f1f21
--- /dev/null
+++ b/gnu/packages/patches/imlib2-CVE-2016-4024.patch
@@ -0,0 +1,52 @@
+Fix CVE-2016-4024 (integer overflow in lib/image.h).
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024
+
+Upstream source:
+https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227
+
+From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001
+From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
+Date: Wed, 6 Apr 2016 03:34:01 +0300
+Subject: Fix integer overflow resulting in insufficient heap allocation
+
+IMAGE_DIMENSIONS_OK ensures that image width and height are less then
+46340, so that maximum number of pixels is ~2**31.
+
+Unfortunately, there are a lot of code that allocates image data with
+something like
+
+   malloc(w * h * sizeof(DATA32));
+
+Obviously, on 32-bit machines this results in integer overflow,
+insufficient heap allocation, with [massive] out-of-bounds heap
+overwrite.
+Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to
+not exceed ULONG_MAX/sizeof(DATA32).
+
+Security implications:
+*) for 32-bit machines: insufficient heap allocation and heap overwrite
+in many image loaders, with escalation potential to remote code
+execution;
+*) for 64-bit machines: it seems, no impact.
+---
+ src/lib/image.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/image.h b/src/lib/image.h
+index e9eb678..5fae6ed 100644
+--- a/src/lib/image.h
++++ b/src/lib/image.h
+@@ -188,7 +188,8 @@ void                __imlib_SaveImage(ImlibImage * im, const char *file,
+ 
+ /* The maximum pixmap dimension is 65535. */
+ /* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
+-#define X_MAX_DIM 46340
++/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */
++#define X_MAX_DIM 32767
+ 
+ #define IMAGE_DIMENSIONS_OK(w, h) \
+    ( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) )
+-- 
+cgit v0.12
+
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024
  2016-04-21  3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari
  2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
  2016-04-21  3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari
@ 2016-04-23  3:20 ` Mark H Weaver
  2016-04-23  4:01   ` Leo Famulari
  2 siblings, 1 reply; 5+ messages in thread
From: Mark H Weaver @ 2016-04-23  3:20 UTC (permalink / raw)
  To: Leo Famulari; +Cc: guix-devel

Leo Famulari <leo@famulari.name> writes:

> This applies from a patch from imlib2's source code repository.
>
> The change fixes an integer overflow on 32-bit machines. The upstream
> says:
>
> Security implications:
> *) for 32-bit machines: insufficient heap allocation and heap overwrite
> in many image loaders, with escalation potential to remote code
> execution;
> *) for 64-bit machines: it seems, no impact.
>
> In the patch file, there are references to imlib2's source repo and the
> CVE page on Mitre.
>
> I tested that feh and scrot still work with this change.

Looks good to me.  Please push.

     Thanks!
       Mark

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024
  2016-04-23  3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver
@ 2016-04-23  4:01   ` Leo Famulari
  0 siblings, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2016-04-23  4:01 UTC (permalink / raw)
  To: Mark H Weaver; +Cc: guix-devel

On Fri, Apr 22, 2016 at 11:20:17PM -0400, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
> 
> > This applies from a patch from imlib2's source code repository.
> >
> > The change fixes an integer overflow on 32-bit machines. The upstream
> > says:
> >
> > Security implications:
> > *) for 32-bit machines: insufficient heap allocation and heap overwrite
> > in many image loaders, with escalation potential to remote code
> > execution;
> > *) for 64-bit machines: it seems, no impact.
> >
> > In the patch file, there are references to imlib2's source repo and the
> > CVE page on Mitre.
> >
> > I tested that feh and scrot still work with this change.
> 
> Looks good to me.  Please push.

Done as e993fb84

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2016-04-23  4:01 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-21  3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari
2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
2016-04-21  3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari
2016-04-23  3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver
2016-04-23  4:01   ` Leo Famulari

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.