Re: Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash)

[Salvatore Bonaccorso <carnil () debian org>]

Hi,

On Wed, Jun 29, 2016 at 09:27:58PM -0400, cve-assign () mitre org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > There is currently PHP upstream bug which is still marked as private:
> >
> > https://bugs.php.net/bug.php?id=72494
> >
> > But the libgd project references the following set of commits to this
> > bug report:
> >
> > https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae
> >
> > indicating that libgd does not properly handle invalid color index,
> > which could lead to a denial of service against applications using the
> > libgd library (in particular thus PHP).
>
> > https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
> > gd_crop.c
> > gdImageCropThreshold
> >
> > + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
> > + return NULL;
> > + }
>
> > https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96
> > tests/gdimagecrop/php_bug_72494.c
> >
> > im = gdImageCreate(50, 50);
> > gdImageCropThreshold(im, 1337, 0);
> > gdImageDestroy(im);
>
> Use CVE-2016-6128.

Thanks for the CVE assignment. Just for the record, my above commit
range stated should have better been written as

https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd

including
https://github.com/libgd/libgd/commit/a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa

Regards,
Salvatore