Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7

[Stefan Cornelius <scorneli () redhat com>]

On Mon, 1 Jun 2015 03:06:57 -0500
Fernando Muñoz <fernando () null-life com> wrote:

> libwmf is affected by a heap overflow on the function that decodes
> BMP images.
>
> WMF files may contain both vector graphics and bitmap components. With
> the attached WMF file, the issue can be reproduced, an overflow
> happens because image_size gets a value of 32, that space is used to
> allocate data->image

There's another issue related to the RLE decoding. DecodeImage() does
not check that the run-length "count" fits into the total size of the
image, which can lead to a heap-based buffer overflow. I've not
assigned a CVE ID to this (mainly because I'm not sure if this
warrants a new CVE or should be bundled with CVE-2015-0848, so I leave
that up to the CVE experts on the list).

We have some possible fixes in our bug [1], but be cautious - these are
not fully vetted yet. So far, however, they look fine to me.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1227243
-- 
Stefan Cornelius / Red Hat Product Security

Come talk to Red Hat Product Security at the Summit!
Red Hat Summit 2015 - https://www.redhat.com/summit/