Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 30 Jun 2016 14:14:25 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: CVE Request: libgd: Invalid color index is
 not properly handled leading to denial of service (crash)

Hi,

On Wed, Jun 29, 2016 at 09:27:58PM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> > There is currently PHP upstream bug which is still marked as private:
> > 
> > https://bugs.php.net/bug.php?id=72494
> > 
> > But the libgd project references the following set of commits to this
> > bug report:
> > 
> > https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae
> > 
> > indicating that libgd does not properly handle invalid color index,
> > which could lead to a denial of service against applications using the
> > libgd library (in particular thus PHP).
> 
> > https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
> > gd_crop.c
> > gdImageCropThreshold
> > 
> > + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
> > + return NULL;
> > + }
> 
> > https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96
> > tests/gdimagecrop/php_bug_72494.c
> > 
> > im = gdImageCreate(50, 50);
> > gdImageCropThreshold(im, 1337, 0);
> > gdImageDestroy(im);
> 
> Use CVE-2016-6128.

Thanks for the CVE assignment. Just for the record, my above commit
range stated should have better been written as

https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd

including
https://github.com/libgd/libgd/commit/a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa

Regards,
Salvatore

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ