Re: Re: CVE request: Heap overflow with a gif file in gdk-pixbuf < 2.32.1

[Yann Droneaud <ydroneaud () opteya com>]

Hi,


Le jeudi 01 octobre 2015 à 12:25 -0300, Gustavo Grieco a écrit :
> 2015-10-01 10:03 GMT-03:00 Gustavo Grieco <gustavo.grieco () gmail com>:
>
> > We found a heap overflow in the gdk-pixbuf implementation triggered 
> > by the scaling of gif file.These issues are only fixed in the 
> > recent release of gdk-pixbuf 2.32.1 but affects older versions (we 
> > tested it in a fully updated Ubuntu 14.04).
>
>
> If someone needs more details, it was fixed in 2.32.1 with this
> commit:
> https://git.gnome.org/browse/gdk-pixbuf/commit/?id=e9a5704edaa9aee949
> 8f1fbf6e1b70fcce2e55aa

The patch fixes pixops_scale_nearest() but AFAICT I think the same
should be applied to other functions has they use the same construct:

- pixops_composite_nearest()

https://git.gnome.org/browse/gdk-pixbuf/tree/gdk-pixbuf/pixops/pixops.c?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa#n339

- pixops_composite_color_nearest()

https://git.gnome.org/browse/gdk-pixbuf/tree/gdk-pixbuf/pixops/pixops.c?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa#n504

- pixops_process()

https://git.gnome.org/browse/gdk-pixbuf/tree/gdk-pixbuf/pixops/pixops.c?id=e9a5704edaa9aee9498f1fbf6e1b70fcce2e55aa#n1316

Regards.

-- 
Yann Droneaud
OPTEYA