Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1tlcdwEPn+AOVZV4UhoZ2bNo7L8@5RY6ROcUbLuHED60eZqMyxBEGG8>
Date: Tue, 25 Nov 2008 15:38:30 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...re.org>, Michael Sweet <mike@...ysw.com>
Subject: Re: CVE request: cups - potential integer overflow
	in PNG image reader [was: CUPS DoS via RSS subscriptions]

Jan, good day.

Tue, Nov 25, 2008 at 12:39:00PM +0100, Jan Lieskovsky wrote:
> Eygene - Thanks for the post!

No problems ;))

> Btw. this CHANGES-1.3.txt files also
> mentions another security flaw, i.e incomplete fix for CVE-2008-1722:
> 
> <cite>
> 
> - SECURITY: The PNG image reading code did not validate the
> 	  image size properly, leading to a potential buffer overflow
> 	  (STR #2974)
> 
> </cite>

Oops, thanks for spotting this!

> The relevant upstream cups BTS post together with patch attached is
> here:
> 
> Advisory: http://www.cups.org/str.php?L2974
> Patch: http://www.cups.org/strfiles/2974/str2974.patch

Hmm, my brains aren't in a perfect shape today, so I could be missing
some important point, but I don't understand how swapping 'xsize' and
'ysize' can help to fix anything.  IIRC, the order of multiplication
isn't guaranteed and multiplication is commutative, so 'xsize' and
'ysize' both are equally good or bad and one can not prefer either.

What am I missing here?
-- 
Eygene

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.