![]() |
|
Date: Mon, 11 Jan 2016 14:03:35 +0100 From: Stefan Cornelius <scorneli@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: Re: Integer overflow in the JasPer's jas_matrix_create() function On Thu, 7 Jan 2016 21:41:57 -0500 (EST) cve-assign@...re.org wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > >> https://bugzilla.redhat.com/show_bug.cgi?id=1294039 > > > We find a vulnerability in the way JasPer's jas_matrix_create() > > function parsed certain JPEG 2000 image files. > > > > jas_matrix_t *jas_matrix_create(int numrows, int numcols) > > { > > ....... > > > > if (matrix->maxrows_ > 0) { > > if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ * > > sizeof(jas_seqent_t *)))) { > > > > > matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *) > > can cause Integer overflow. > > > > Despite this library is used by many programs > > (http://www.ece.uvic.ca/~frodo/jasper/#overview), there is no one > > providing support. > > Use CVE-2015-8751. > Hi, Just a quick heads-up: We at Red Hat originally fixed this as part of the patch for CVE-2008-3520. This was a rather big patch and closed a lot of potential integer overflows (originally from OpenBSD?). I imagine a lot of distros used the same patch. The original description for CVE-2008-3520 is quite general, so I'm not sure if that's enough to say that CVE-2015-8751 is a dupe or not. -- Stefan Cornelius / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.