[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: apng2gif issues

Hi Salvatore

I tried to reproduce to see whether that gives a hint on whether the problem is in wheezy or not. It was not "a final say" so to say.
You probably did not get the email sent to the maintainer. There I stated that there may be two other issues too, but I could not reproduce it.

Best regards

// Ola

On 21 March 2017 at 07:03, Salvatore Bonaccorso <carnil@debian.org> wrote:
Hi Ola,

On Tue, Mar 21, 2017 at 06:52:59AM +0100, Salvatore Bonaccorso wrote:
> Hello Ola!
> I noticed you started triaging apng2gif for wheezy. Please note, do
> always not conclude that when a reproducer fails, that the issue is
> not present, the issue needs to be triaged as well studing the source.
> And the reporter has given here the hints for what the CVEs are
> assigned (actually done, after he pinged the security team, and I
> asked to request them via MITRE since the bugs already public in the
> BTS).
> I guess this is not necessary to say, but I just wanted to make sure
> how is our approach for issues.
> If you compile the sid version with ASAN you can see the issues
> reported by Dileep Kumar Jallepall, apart the memory allocation issue.
> I tend to mark the issues as no-dsa for jessie at least. For
> sid/stretch we maybe are actually better off if it is removed, since
> basically dead upstream afaict.
> Does this helps? I'm writing you since I saw your comments on the
> three bugs.

Sorry should add: I agree the code has significantly changed between
1.5 and 1.7, so code analisis might show that the issues are really
not present for wheezy and jessie. For example the #854447 issue might
only be present in 1.7, since the affected code seems introduced after

Hope this gives some hints.


 --- Inguza Technology AB --- MSc in Information Technology ----
/  ola@inguza.com                    Folkebogatan 26            \
|  opal@debian.org                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /

Reply to: