Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 30 Jun 2016 14:14:25 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: CVE Request: libgd: Invalid color index is
 not properly handled leading to denial of service (crash)

Hi,

On Wed, Jun 29, 2016 at 09:27:58PM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> > There is currently PHP upstream bug which is still marked as private:
> > 
> > https://bugs.php.net/bug.php?id=72494
> > 
> > But the libgd project references the following set of commits to this
> > bug report:
> > 
> > https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae
> > 
> > indicating that libgd does not properly handle invalid color index,
> > which could lead to a denial of service against applications using the
> > libgd library (in particular thus PHP).
> 
> > https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
> > gd_crop.c
> > gdImageCropThreshold
> > 
> > + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
> > + return NULL;
> > + }
> 
> > https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96
> > tests/gdimagecrop/php_bug_72494.c
> > 
> > im = gdImageCreate(50, 50);
> > gdImageCropThreshold(im, 1337, 0);
> > gdImageDestroy(im);
> 
> Use CVE-2016-6128.

Thanks for the CVE assignment. Just for the record, my above commit
range stated should have better been written as

https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd

including
https://github.com/libgd/libgd/commit/a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa

Regards,
Salvatore

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.