Date: Fri, 22 Sep 2023 17:35:16 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Cc: Vincent Rabaud <vrabaud@...gle.com> Subject: Re: CVE-2023-4863: libwebp: Heap buffer overflow in WebP Codec On Fri, Sep 22, 2023 at 04:50:44PM +0200, Vincent Rabaud wrote: > Hi, we have commented on that here: > https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62136#c7 Thank you! I include the relevant comments below: > Comment 6 by t...@...ter.vg on Mon, Sep 18, 2023, 4:58 PM GMT+2 > > Can I request a CVE assignment for this issue (so I can note it > correctly in Firefox advisories)? > > Comment 7 by jz...@...gle.com on Tue, Sep 19, 2023, 3:22 AM GMT+2 > > This was an incorrect check in an assert(). A release build would not be > negatively affected. The conditions were updated, but previously the > file would not cause an issue in that mode. Vincent, please correct me > if I'm wrong. > > Comment 8 by vrabaud@...gle.com on Tue, Sep 19, 2023, 11:08 AM GMT+2 > > Exactly. And instead of fixing the assert, the patch uses an early exit > to not reach the assert, which is also an optimization. Vincent, what about these commits? - commit dce8397fec159c9edfeec7c6388cb81428c87ed8 Author: Masahiro Hanada <hanada@...ark-techno.com> Date: Thu Sep 14 19:37:24 2023 +0900 Fix next is invalid pointer when WebPSafeMalloc fails When WebPSafeMalloc fails on VP8LHuffmanTablesAllocate, next is not initialized to NULL. VP8LHuffmanTablesDeallocate uses next to know the following nodes. A patch fixes this issue. Change-Id: I144ae84cd97e5bca227018ef1afa95361267902c commit 433c7dca11bb5b001ce5ad36ac1afd2906a2f13e Author: Vincent Rabaud <vrabaud@...gle.com> Date: Thu Sep 14 09:31:19 2023 +0200 Fix static analyzer warnings. Change-Id: I45f0db2310b1188809963af93240e3d438f807b8 The "next is not initialized to NULL" one sounds like it could mean stale memory contents (possibly deliberately sprayed) could be used as a pointer, so it could be a security issue. The warnings fixes could be just that, or some of those warnings could have been for real issues (perhaps also something used uninitialized). In other words, are the issues fixed there known to be benign, are not sufficiently researched, or researched and known to be vulnerabilities? Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.