[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 11 Jan 2016 14:03:35 +0100
From: Stefan Cornelius <scorneli@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Integer overflow in the JasPer's
jas_matrix_create() function
On Thu, 7 Jan 2016 21:41:57 -0500 (EST)
cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> >> https://bugzilla.redhat.com/show_bug.cgi?id=1294039
>
> > We find a vulnerability in the way JasPer's jas_matrix_create()
> > function parsed certain JPEG 2000 image files.
> >
> > jas_matrix_t *jas_matrix_create(int numrows, int numcols)
> > {
> > .......
> >
> > if (matrix->maxrows_ > 0) {
> > if (!(matrix->rows_ = jas_malloc(matrix->maxrows_ *
> > sizeof(jas_seqent_t *)))) {
> >
>
> > matrix->maxrows_ > 0 ,but matrix->maxrows_ *sizeof(jas_seqent_t *)
> > can cause Integer overflow.
> >
> > Despite this library is used by many programs
> > (http://www.ece.uvic.ca/~frodo/jasper/#overview), there is no one
> > providing support.
>
> Use CVE-2015-8751.
>
Hi,
Just a quick heads-up: We at Red Hat originally fixed this as part of
the patch for CVE-2008-3520. This was a rather big patch and
closed a lot of potential integer overflows (originally from
OpenBSD?). I imagine a lot of distros used the same patch.
The original description for CVE-2008-3520 is quite general, so I'm
not sure if that's enough to say that CVE-2015-8751 is a dupe or not.
--
Stefan Cornelius / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
