Fix CVE-2016-4024 (integer overflow in lib/image.h). https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024 Upstream source: https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227 From 7eba2e4c8ac0e20838947f10f29d0efe1add8227 Mon Sep 17 00:00:00 2001 From: "Yuriy M. Kaminskiy" Date: Wed, 6 Apr 2016 03:34:01 +0300 Subject: Fix integer overflow resulting in insufficient heap allocation IMAGE_DIMENSIONS_OK ensures that image width and height are less then 46340, so that maximum number of pixels is ~2**31. Unfortunately, there are a lot of code that allocates image data with something like malloc(w * h * sizeof(DATA32)); Obviously, on 32-bit machines this results in integer overflow, insufficient heap allocation, with [massive] out-of-bounds heap overwrite. Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to not exceed ULONG_MAX/sizeof(DATA32). Security implications: *) for 32-bit machines: insufficient heap allocation and heap overwrite in many image loaders, with escalation potential to remote code execution; *) for 64-bit machines: it seems, no impact. --- src/lib/image.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/lib/image.h b/src/lib/image.h index e9eb678..5fae6ed 100644 --- a/src/lib/image.h +++ b/src/lib/image.h @@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file, /* The maximum pixmap dimension is 65535. */ /* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */ -#define X_MAX_DIM 46340 +/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */ +#define X_MAX_DIM 32767 #define IMAGE_DIMENSIONS_OK(w, h) \ ( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) ) -- cgit v0.12