Re: tiff / CVE-2018-18661
Ola Lundqvist <ola@inguza.com> writes:
> Hi Brian
>
> To me it looks like you have been able to reproduce the problem. You
> clearly get different results with and without the patch indicating
> that you have in fact triggered the problem. I do not see that you
> have run the program using a debugger, so are you sure that you did
> not end up in a crash?
Looks like it it exiting normally to me:
(jessie-amd64-default)root@silverfish:/tmp/brian/tmph6ow42nt/build/amd64# gdb tiff2bw
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from tiff2bw...(no debugging symbols found)...done.
(gdb) set args /tmp/poc /dev/null
(gdb) r
Starting program: /usr/bin/tiff2bw /tmp/poc /dev/null
TIFFReadDirectory: Warning, Unknown field with tag 292 (0x124) encountered.
LZWDecode: Not enough data at scanline 0 (short 6442004472 bytes).
TIFFWriteDirectoryTagData: IO error writing tag data.
[Inferior 1 (process 31103) exited normally]
(gdb)
--
Brian May <bam@debian.org>
Reply to: