Hello,
I fix this bug yesterday in the git repository. Please contact me before
working on it next time (I am not yet on VAC). I appreciate your work
but I am sorry it is a duplicate (and not using the same approach, since
I split the patch).
Thanks anyway.
Regards
Sylvain Le Gall
On Sat, Aug 08, 2009 at 05:59:04PM +1000, Steffen Joeris wrote:
> Hi
>
> I'd suggest going with gentoo's approach of using a separate oversized.h file.
> Any objections? I've tried building this, but the debdiff between the -dev
> binary packages was quite huge, so I am not uploading anything.
>
> Cheers
> Steffen
>
> [0]: https://bugs.gentoo.org/attachment.cgi?id=199108&action=view
> diff -u camlimages-3.0.1/debian/changelog camlimages-3.0.1/debian/changelog
> --- camlimages-3.0.1/debian/changelog
> +++ camlimages-3.0.1/debian/changelog
> @@ -1,3 +1,12 @@
> +camlimages (1:3.0.1-2.1) unstable; urgency=high
> +
> + * Non-maintainer upload by the security team
> + * Expand security patch for integer overflows to also cover other
> + image types (Closes: #540146)
> + Fixes: CVE-2009-2660
> +
> + -- Steffen Joeris <white@debian.org> Sat, 08 Aug 2009 07:05:38 +0000
> +
> camlimages (1:3.0.1-2) unstable; urgency=low
>
> [ Mehdi Dogguy ]
> diff -u camlimages-3.0.1/debian/patches/fix_integer_overflows.dpatch camlimages-3.0.1/debian/patches/fix_integer_overflows.dpatch
> --- camlimages-3.0.1/debian/patches/fix_integer_overflows.dpatch
> +++ camlimages-3.0.1/debian/patches/fix_integer_overflows.dpatch
> @@ -8,82 +8,155 @@
> -diff -urNad camlimages~/src/pngread.c camlimages/src/pngread.c
> ---- camlimages~/src/pngread.c 2009-06-23 11:22:20.000000000 +0200
> -+++ camlimages/src/pngread.c 2009-07-03 17:51:31.000000000 +0200
> -@@ -15,6 +15,8 @@
> - #include "config.h"
> - #endif
> -
> -+#include <limits.h>
> +Index: src/gifread.c
> +===================================================================
> +--- src/gifread.c.orig
> ++++ camlimages-3.0.1/src/gifread.c
> +@@ -20,6 +20,8 @@
> + #include <caml/memory.h>
> + #include <caml/fail.h>
> +
> ++#include "oversized.h"
> ++
> + #include <stdio.h>
> + #include <string.h>
> +
> +@@ -191,6 +193,9 @@ value dGifGetLine( value hdl )
> +
> + GifFileType *GifFile = (GifFileType*) hdl;
> +
> ++ if( oversized( GifFile->Image.Width, sizeof(GifPixelType) ) ){
> ++ failwith_oversized("gif");
> ++ }
> + buf = alloc_string( GifFile->Image.Width * sizeof(GifPixelType) );
> +
> + if( DGifGetLine(GifFile, String_val(buf), GifFile->Image.Width )
> +Index: src/jpegread.c
> +===================================================================
> +--- src/jpegread.c.orig
> ++++ camlimages-3.0.1/src/jpegread.c
> +@@ -20,6 +20,8 @@
> + #include <caml/memory.h>
> + #include <caml/fail.h>
> +
> ++#include "oversized.h"
> ++
> + #include <stdio.h>
> + #include <string.h>
> +
> +@@ -156,6 +158,12 @@ read_JPEG_file (value name)
> + */
> + /* JSAMPLEs per row in output buffer */
> +
> ++ if( oversized(cinfo.output_width, cinfo.output_components) ){
> ++ jpeg_destroy_decompress(&cinfo);
> ++ fclose(infile);
> ++ failwith_oversized("jpeg");
> ++ }
> ++
> + row_stride = cinfo.output_width * cinfo.output_components;
> +
> + /* Make a one-row-high sample array that will go away when done with image */
> +@@ -177,6 +185,12 @@ read_JPEG_file (value name)
> + jpeg_read_scanlines(&cinfo, buffer + cinfo.output_scanline, 1);
> + }
> +
> ++ if( oversized(row_stride, cinfo.output_height) ){
> ++ jpeg_destroy_decompress(&cinfo);
> ++ fclose(infile);
> ++ failwith_oversized("jpeg");
> ++ }
> +
> - #include <png.h>
> -
> - #include <caml/mlvalues.h>
> -@@ -26,6 +28,12 @@
> - #define PNG_TAG_INDEX16 2
> - #define PNG_TAG_INDEX4 3
> -
> + {
> + CAMLlocalN(r,3);
> + r[0] = Val_int(cinfo.output_width);
> +@@ -352,6 +366,7 @@ value open_jpeg_file_for_read_start( jpe
> +
> + {
> + CAMLlocalN(r,3);
> ++ // CR jfuruse: integer overflow
> + r[0] = Val_int(cinfop->output_width);
> + r[1] = Val_int(cinfop->output_height);
> + r[2] = alloc_tuple(3);
> +Index: src/oversized.h
> +===================================================================
> +--- /dev/null
> ++++ camlimages-3.0.1/src/oversized.h
> +@@ -0,0 +1,9 @@
> ++#include <limits.h>
> +/* Test if x or y are negative, or if multiplying x * y would cause an
> + * arithmetic overflow.
> + */
> +#define oversized(x, y) \
> + ((x) < 0 || (y) < 0 || ((y) != 0 && (x) > INT_MAX / (y)))
> +
> - value read_png_file_as_rgb24( name )
> - value name;
> - {
> -@@ -81,6 +89,9 @@
> ++#define failwith_oversized(lib) \
> ++ failwith("#lib error: image contains oversized or bogus width and height");
> +Index: src/pngread.c
> +===================================================================
> +--- src/pngread.c.orig
> ++++ camlimages-3.0.1/src/pngread.c
> +@@ -17,6 +17,8 @@
> +
> + #include <png.h>
> +
> ++#include "oversized.h"
> ++
> + #include <caml/mlvalues.h>
> + #include <caml/alloc.h>
> + #include <caml/memory.h>
> +@@ -81,6 +83,9 @@ value read_png_file_as_rgb24( name )
> png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
> &interlace_type, NULL, NULL);
>
> + if (oversized (width, height))
> -+ failwith ("png error: image contains oversized or bogus width and height");
> ++ failwith_oversized("png");
> +
> if ( color_type == PNG_COLOR_TYPE_GRAY ||
> color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) {
> png_set_gray_to_rgb(png_ptr);
> -@@ -102,10 +113,16 @@
> +@@ -102,10 +107,16 @@ value read_png_file_as_rgb24( name )
>
> rowbytes = png_get_rowbytes(png_ptr, info_ptr);
>
> + if (oversized (rowbytes, height))
> -+ failwith ("png error: image contains oversized or bogus rowbytes and height");
> ++ failwith_oversized("png");
> +
> {
> int i;
> png_bytep *row_pointers;
>
> + if (oversized (sizeof (png_bytep), height))
> -+ failwith ("png error: image contains oversized or bogus height");
> ++ failwith_oversized("png");
> +
> row_pointers = (png_bytep*) stat_alloc(sizeof(png_bytep) * height);
>
> res = alloc_tuple(3);
> -@@ -235,6 +252,9 @@
> +@@ -235,6 +246,9 @@ value read_png_file( name )
> png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type,
> &interlace_type, NULL, NULL);
>
> + if (oversized (width, height))
> -+ failwith ("png error: image contains oversized or bogus width and height");
> ++ failwith_oversized("png");
> +
> if ( color_type == PNG_COLOR_TYPE_GRAY ||
> color_type == PNG_COLOR_TYPE_GRAY_ALPHA ) {
> png_set_gray_to_rgb(png_ptr);
> -@@ -251,6 +271,9 @@
> +@@ -251,6 +265,9 @@ value read_png_file( name )
>
> rowbytes = png_get_rowbytes(png_ptr, info_ptr);
>
> + if (oversized (rowbytes, height))
> -+ failwith ("png error: image contains oversized or bogus rowbytes and height");
> ++ failwith_oversized("png");
> +
> /*
> fprintf(stderr, "pngread.c: actual loading\n"); fflush(stderr);
> */
> -@@ -259,6 +282,9 @@
> +@@ -259,6 +276,9 @@ fprintf(stderr, "pngread.c: actual loadi
> png_bytep *row_pointers;
> char mesg[256];
>
> + if (oversized (sizeof (png_bytep), height))
> -+ failwith ("png error: image contains oversized or bogus height");
> ++ failwith_oversized("png");
> +
> row_pointers = (png_bytep*)stat_alloc(sizeof(png_bytep) * height);
> res = alloc_tuple(3);
>
> +
Attachment:
signature.asc
Description: Digital signature