Date: Wed, 5 Oct 2016 22:43:19 -0300 From: Gustavo Grieco <gustavo.grieco@...il.com> To: oss-security@...ts.openwall.com Subject: librsvg and cairo are causing libpng to write out-of-bounds Hello, We found a write out-of-bounds affecting librsvg 2.40 and cairo 1.14.6 (but other versions could be affected). It was tested in ArchLinux (x86_64). In this odd issue, the interaction between librsvg and cairo is somehow causing the function png_write_row in libpng to write out of bounds. To reproduce: $ gdb --args rsvg-convert -o /dev/null libpng-crash.svg ... Thread 1 "rsvg-convert" received signal SIGSEGV, Segmentation fault. 0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from /usr/lib/libc.so.6 #1 0x00007ffff423cce8 in png_write_row () from /usr/lib/libpng16.so.16 #2 0x00007ffff423d0ab in png_write_image () from /usr/lib/libpng16.so.16 #3 0x00007ffff7046455 in ?? () from /usr/lib/libcairo.so.2 #4 0x00007ffff7046e09 in cairo_surface_write_to_png_stream () from /usr/lib/libcairo.so.2 #5 0x00000000004021c6 in ?? () #6 0x00007ffff66f0291 in __libc_start_main () from /usr/lib/libc.so.6 #7 0x0000000000402a49 in ?? () I don't think there is bug in libpng, but i'm not sure where the other libraries are failing. Interestingly enough, there is no indication of invalid memory reads or writes before the crash. The compressed reproducer is attached. Hopefully someone will be able to find and isolate this vulnerability. Regards, Gustavo. Download attachment "libpng-crash.svg.gz" of type "application/x-gzip" (17949 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.