[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 5 Oct 2016 22:43:19 -0300
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: librsvg and cairo are causing libpng to write out-of-bounds
Hello,
We found a write out-of-bounds affecting librsvg 2.40 and cairo 1.14.6
(but other versions could be affected). It was tested in ArchLinux
(x86_64). In this odd issue, the interaction between librsvg and cairo
is somehow causing the function png_write_row in libpng to write out
of bounds. To reproduce:
$ gdb --args rsvg-convert -o /dev/null libpng-crash.svg
...
Thread 1 "rsvg-convert" received signal SIGSEGV, Segmentation fault.
0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from /usr/lib/libc.so.6
(gdb) bt
#0 0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from
/usr/lib/libc.so.6
#1 0x00007ffff423cce8 in png_write_row () from /usr/lib/libpng16.so.16
#2 0x00007ffff423d0ab in png_write_image () from /usr/lib/libpng16.so.16
#3 0x00007ffff7046455 in ?? () from /usr/lib/libcairo.so.2
#4 0x00007ffff7046e09 in cairo_surface_write_to_png_stream () from
/usr/lib/libcairo.so.2
#5 0x00000000004021c6 in ?? ()
#6 0x00007ffff66f0291 in __libc_start_main () from /usr/lib/libc.so.6
#7 0x0000000000402a49 in ?? ()
I don't think there is bug in libpng, but i'm not sure where the other
libraries are failing. Interestingly enough, there is no indication of
invalid memory reads or writes before the crash.
The compressed reproducer is attached. Hopefully someone will be able
to find and isolate this vulnerability.
Regards,
Gustavo.
Download attachment "libpng-crash.svg.gz" of type "application/x-gzip" (17949 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
