--- Begin Message ---
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
X-Debbugs-Cc: libwebp@packages.debian.org, jmm@debian.org, carnil@debian.org
Control: affects -1 + src:libwebp
Hi release team,
Please unblock package libwebp
[ Reason ]
libwebp is affected by CVE-2023-1999, #1035371 which is going to be
fixed as well by Moritz in a DSA.
[ Impact ]
If unfixed in bookworm, we will have a security regression from
bullseye to bookworm (until as well fixed via an upload there). To
avoid this situation, I uploaded to unstable the fix pending for
bullseye-security.
[ Tests ]
Unfortunately none specific to CVE-2023-1999. The original bugreport
are not public.
[ Risks ]
The patch is isolated for the changes and clears the result-bw on
error plus the return value of VP8BitWriterInit() get newly checked.
So there is no complex code change.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
Nothing, special. DSA should go out in the next few days.
unblock libwebp/1.2.4-0.2
Regards,
Salvatore
diff -Nru libwebp-1.2.4/debian/changelog libwebp-1.2.4/debian/changelog
--- libwebp-1.2.4/debian/changelog 2023-01-23 14:28:25.000000000 +0100
+++ libwebp-1.2.4/debian/changelog 2023-05-19 14:50:58.000000000 +0200
@@ -1,3 +1,11 @@
+libwebp (1.2.4-0.2) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * EncodeAlphaInternal: clear result->bw on error (CVE-2023-1999)
+ (Closes: #1035371)
+
+ -- Salvatore Bonaccorso <carnil@debian.org> Fri, 19 May 2023 14:50:58 +0200
+
libwebp (1.2.4-0.1) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru libwebp-1.2.4/debian/patches/EncodeAlphaInternal-clear-result-bw-on-error.patch libwebp-1.2.4/debian/patches/EncodeAlphaInternal-clear-result-bw-on-error.patch
--- libwebp-1.2.4/debian/patches/EncodeAlphaInternal-clear-result-bw-on-error.patch 1970-01-01 01:00:00.000000000 +0100
+++ libwebp-1.2.4/debian/patches/EncodeAlphaInternal-clear-result-bw-on-error.patch 2023-05-19 14:50:58.000000000 +0200
@@ -0,0 +1,57 @@
+From: James Zern <jzern@google.com>
+Date: Wed, 22 Feb 2023 22:15:47 -0800
+Subject: EncodeAlphaInternal: clear result->bw on error
+Origin: https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129
+Bug-Debian: https://bugs.debian.org/1035371
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-1999
+
+This avoids a double free should the function fail prior to
+VP8BitWriterInit() and a previous trial result's buffer carried over.
+Previously in ApplyFiltersAndEncode() trial.bw (with a previous
+iteration's buffer) would be freed, followed by best.bw pointing to the
+same buffer.
+
+Since:
+187d379d add a fallback to ALPHA_NO_COMPRESSION
+
+In addition, check the return value of VP8BitWriterInit() in this
+function.
+
+Bug: webp:603
+Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910
+---
+ src/enc/alpha_enc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c
+index f7c02690e3cf..7d205586fe77 100644
+--- a/src/enc/alpha_enc.c
++++ b/src/enc/alpha_enc.c
+@@ -13,6 +13,7 @@
+
+ #include <assert.h>
+ #include <stdlib.h>
++#include <string.h>
+
+ #include "src/enc/vp8i_enc.h"
+ #include "src/dsp/dsp.h"
+@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
+ }
+ } else {
+ VP8LBitWriterWipeOut(&tmp_bw);
++ memset(&result->bw, 0, sizeof(result->bw));
+ return 0;
+ }
+ }
+@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data, int width, int height,
+ header = method | (filter << 2);
+ if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4;
+
+- VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size);
++ if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0;
+ ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN);
+ ok = ok && VP8BitWriterAppend(&result->bw, output, output_size);
+
+--
+2.40.1
+
diff -Nru libwebp-1.2.4/debian/patches/series libwebp-1.2.4/debian/patches/series
--- libwebp-1.2.4/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ libwebp-1.2.4/debian/patches/series 2023-05-19 14:50:58.000000000 +0200
@@ -0,0 +1 @@
+EncodeAlphaInternal-clear-result-bw-on-error.patch
--- End Message ---