oss-sec mailing list archives
Re: GraphicsMagick 1.3.25 fixes some security issues
From: Bob Friesenhahn <bfriesen () simple dallas tx us>
Date: Fri, 9 Sep 2016 09:56:49 -0500 (CDT)
On Fri, 9 Sep 2016, Agostino Sarubbo wrote:
On Tuesday 06 September 2016 20:50:23 Bob Friesenhahn wrote:4. The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software.For who is interested, the details of the issue N° 4 are documented here: https://blogs.gentoo.org/ago/2016/08/23/graphicsmagick-two-heap-based-buffer-overflow-in-readtiffimage-tiff-c/[1]
The problem was due to the definition of strlcpy() in that it is supposed to return the number of characters which would have been copied if the destination buffer was large enough. To satisfy this requirement, strlcpy() needs to continue scanning memory until it encounters a null byte in memory.
The strlcpy() function has very nice properties but this weakness is something that developers need to be aware of.
Bob -- Bob Friesenhahn bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Current thread:
- GraphicsMagick 1.3.25 fixes some security issues Bob Friesenhahn (Sep 06)
- Re: GraphicsMagick 1.3.25 fixes some security issues Agostino Sarubbo (Sep 09)
- Re: GraphicsMagick 1.3.25 fixes some security issues Bob Friesenhahn (Sep 09)
- Re: GraphicsMagick 1.3.25 fixes some security issues cve-assign (Sep 18)
- Re: GraphicsMagick 1.3.25 fixes some security issues Agostino Sarubbo (Sep 09)