Date: Fri, 23 Nov 2018 19:33:55 -0600 (CST) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: Re: Crashes and memory safety bugs in dcraw On Fri, 23 Nov 2018, Ian Zimmerman wrote: > An important side note: because dcraw intentionally doesn't provide a > library, only an executable, code from it is bundled in at least some > applications that use it; thus updating the dcraw package in a distro > will not by itself be the end of this problem for the distro. One such > application : RawTherapee GraphicsMagick also bundles some version of dcraw for its Microsoft Windows builds. It is executed as an external program so if it becomes corrupted, it will not corrupt the invoking application. Another consideration is that the dcraw author has huge sample image archive that he is only willing to sell for private use. This means that other projects (including those which derived code from dcraw) might not work correctly with as many input files since they have not done as much validation. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/ Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.