Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Jul 2010 08:41:17 -0700
From: "John Bowler" <jbowler@...ntiernet.net>
To: <oss-security@...ts.openwall.com>,
	"'PNG/MNG implementation discussion list'" <png-mng-implement@...ts.sourceforge.net>
Subject: RE: [png-mng-implement] CVE Request -- libpng v1.4.3	and v1.2.44 -- memory leak while processing PNG image with	malformed sCAL chunks

From: Marcus Meissner [mailto:meissner@...e.de] 
>> > > [b], memory-leak bug, involving images with malformed sCAL chunks,
>> > > which could lead to an application crash.
>> oss-sec, png-mng-implement ... do you have testimages or a reproducer for the sCAL issue?
>
>As found on:
>http://code.google.com/p/chromium/issues/detail?id=45983
>
>The sample crashing PNG is:
>http://www.ee.oulu.fi/~aki/spark.png

That doesn't show issue [b] - the sCAL leak.  The original demonstration was provided by a program to generate the test image, because the test image is somewhat large (20MByte with the default settings).  Unfortunately the original program didn't compile, but it's easy to fix (it used a piece of non-exported libpng data, but that data is just the string "sCAL".)

I guess I can post the fixed version, but I'd prefer permission of the person to post it - Vegard Nossum.

The "sample crashing PNG" was generated by radamsa using the 'surfy' fuzzer on the PNGSuite test images to generate broken images.  I've subsequently run radamsa using all the fuzzers and more images without finding more problems, but the more input images that are used the more likely problems will be detected (since there are more patterns for radamsa to find and tweak.)

Radamsa is a Scheme program that, unfortunately, requires its own specific Scheme compiler "owl-lisp" (i.e. it won't compile against Scheme48 and its libraries.)  However, there's a self-contained binary distribution (it contains all the owl libraries required).  More information is here:

http://code.google.com/p/ouspg/wiki/Radamsa

This includes how to download and compile the binary (the download is a decimal encoded Scheme/LISP heap).  The source is somewhat bleeding-edge - I eventually found that I could build radamsa r260 with owl-lisp r83, but that was a long long time ago - June 21.  I also found that I still had to use a binary of owl-lisp to bootstrap it, but by then I was pretty much convinced that it was probably safe ;-)

John Bowler <jbowler@....org>





Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.