summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2016-04-19 23:29:08 -0400
committerLeo Famulari <leo@famulari.name>2016-04-22 23:59:37 -0400
commite993fb849321b740c43d02c922101287426420fa (patch)
tree6461c34ff297d1abc2ffa4c49eb1bc7003bbcada
parentbaa8be83e90e1c61aedcaad3a542316117a568ea (diff)
gnu: imlib2: Fix CVE-2016-4024.
* gnu/packages/patches/imlib2-CVE-2016-4024.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/image.scm (imlib2): Use it.
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/image.scm3
-rw-r--r--gnu/packages/patches/imlib2-CVE-2016-4024.patch52
3 files changed, 55 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 1b54b3a855..74d898c116 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -531,6 +531,7 @@ dist_patch_DATA = \
gnu/packages/patches/icu4c-CVE-2015-4760.patch \
gnu/packages/patches/ilmbase-fix-tests.patch \
gnu/packages/patches/imagemagick-test-segv.patch \
+ gnu/packages/patches/imlib2-CVE-2016-4024.patch \
gnu/packages/patches/irrlicht-mesa-10.patch \
gnu/packages/patches/jasper-CVE-2007-2721.patch \
gnu/packages/patches/jasper-CVE-2008-3520.patch \
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 91d6af6fcc..db64ea0c9b 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -467,7 +467,8 @@ compose, and analyze GIF images.")
version ".tar.bz2"))
(sha256
(base32
- "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9"))))
+ "0xxhgkd1axlcmf3kp1d7naiygparpg8l3sg3d263rhl2z0gm7aw9"))
+ (patches (search-patches "imlib2-CVE-2016-4024.patch"))))
(build-system gnu-build-system)
(native-inputs
`(("pkgconfig" ,pkg-config)))
diff --git a/gnu/packages/patches/imlib2-CVE-2016-4024.patch b/gnu/packages/patches/imlib2-CVE-2016-4024.patch
new file mode 100644
index 0000000000..c4f1f21b28
--- /dev/null
+++ b/gnu/packages/patches/imlib2-CVE-2016-4024.patch
@@ -0,0 +1,52 @@
+Fix CVE-2016-4024 (integer overflow in lib/image.h).
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024
+
+Upstream source:
+https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227
+
+From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001
+From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
+Date: Wed, 6 Apr 2016 03:34:01 +0300
+Subject: Fix integer overflow resulting in insufficient heap allocation
+
+IMAGE_DIMENSIONS_OK ensures that image width and height are less then
+46340, so that maximum number of pixels is ~2**31.
+
+Unfortunately, there are a lot of code that allocates image data with
+something like
+
+ malloc(w * h * sizeof(DATA32));
+
+Obviously, on 32-bit machines this results in integer overflow,
+insufficient heap allocation, with [massive] out-of-bounds heap
+overwrite.
+Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to
+not exceed ULONG_MAX/sizeof(DATA32).
+
+Security implications:
+*) for 32-bit machines: insufficient heap allocation and heap overwrite
+in many image loaders, with escalation potential to remote code
+execution;
+*) for 64-bit machines: it seems, no impact.
+---
+ src/lib/image.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/image.h b/src/lib/image.h
+index e9eb678..5fae6ed 100644
+--- a/src/lib/image.h
++++ b/src/lib/image.h
+@@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file,
+
+ /* The maximum pixmap dimension is 65535. */
+ /* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
+-#define X_MAX_DIM 46340
++/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */
++#define X_MAX_DIM 32767
+
+ #define IMAGE_DIMENSIONS_OK(w, h) \
+ ( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) )
+--
+cgit v0.12
+