Your message dated Fri, 17 Apr 2015 21:35:43 +0000 with message-id <[email protected]> and subject line Bug#773967: fixed in imlib2 1.4.7-1 has caused the Debian Bug report #773967, regarding feh crashes on invalid gif image data to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 773967: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773967 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: feh Version: 2.12-1 Severity: important Feh crashes with segmentation fault when given an invalid gif image in a mode that should help determining if the image can be displayed (-U command line argument). I did run feh on a afl[1]-generated image test sets[2] to figure out if any specific images cause problems for feh. If you try feh with following command line parameters on the attached image, you should see a segmentation fault: $ feh -U id:000293,src:000000,op:havoc,rep:4.gif Segmentation fault I don't know if this opens a security issue, but every segmentation fault has a potential for it. Here is a gdb backtrace of the segmentation fault: (gdb) run -U id:000293,src:000000,op:havoc,rep:4.gif Starting program: /usr/bin/feh -U id:000293,src:000000,op:havoc,rep:4.gif [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00007ffff0023d3c in load () from /usr/lib/x86_64-linux-gnu/imlib2/loaders/gif.so (gdb) bt #0 0x00007ffff0023d3c in load () from /usr/lib/x86_64-linux-gnu/imlib2/loaders/gif.so #1 0x00007ffff6c7188f in ?? () from /usr/lib/x86_64-linux-gnu/libImlib2.so.1 #2 0x00007ffff6c55d3b in imlib_load_image_with_error_return () from /usr/lib/x86_64-linux-gnu/libImlib2.so.1 #3 0x0000555555561930 in ?? () #4 0x0000555555567925 in ?? () #5 0x00005555555679af in ?? () #6 0x000055555555afdc in ?? () #7 0x00007ffff68c5b45 in __libc_start_main (main=0x55555555af00, argc=3, argv=0x7fffffffdfe8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdfd8) at libc-start.c:287 #8 0x000055555555b035 in ?? () [1]: American fuzzy lop - a security-oriented fuzzer: http://lcamtuf.coredump.cx/afl/ [2]: Afl-generated, minimized image test sets: http://lcamtuf.coredump.cx/afl/demo/ -- System Information: Debian Release: 8.0 APT prefers testing APT policy: (990, 'testing'), (100, 'unstable'), (99, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Init: systemd (via /run/systemd/system) Versions of packages feh depends on: ii libc6 2.19-13 ii libcurl3 7.38.0-3 ii libexif12 0.6.21-2 ii libimlib2 1.4.6-2+b3 ii libpng12-0 1.2.50-2+b2 ii libx11-6 2:1.6.2-3 ii libxinerama1 2:1.1.3-1+b1 Versions of packages feh recommends: ii libjpeg-progs 1:9a-2 feh suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: imlib2 Source-Version: 1.4.7-1 We believe that the bug you reported is fixed in the latest version of imlib2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Alessandro Ghedini <[email protected]> (supplier of updated imlib2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 17 Apr 2015 22:58:25 +0200 Source: imlib2 Binary: libimlib2 libimlib2-dev Architecture: source amd64 Version: 1.4.7-1 Distribution: unstable Urgency: medium Maintainer: Alessandro Ghedini <[email protected]> Changed-By: Alessandro Ghedini <[email protected]> Description: libimlib2 - image loading, rendering, saving library libimlib2-dev - image loading, rendering, saving library (development files) Closes: 752554 773967 Changes: imlib2 (1.4.7-1) unstable; urgency=medium . * New upstream release - Fix crash on invalid gif image data (Closes: #773967) * Mark libimlib2 as Multi-Arch: same. Thanks to Frédéric Brière for the patch (Closes: #752554) * Bump Standards-Version to 3.9.6 (no changes needed) * Drop 03_fix-imlib-config-libraries.patch (merged upstream) * Refresh patches * Update symbols file Checksums-Sha1: 4b4059cc18a04ab42fbd60a1c00de438f6d27673 1996 imlib2_1.4.7-1.dsc c47c4e3f62e130742b75da8fd8a21f0fae979cda 1027716 imlib2_1.4.7.orig.tar.gz 1827352acb95784e3872ff046dea1e5fbd51f556 9456 imlib2_1.4.7-1.debian.tar.xz c2da3097f0e5e42651c76122cf353822fbc74cd6 202830 libimlib2_1.4.7-1_amd64.deb 8e90b944150153120f4acf9e88aa5db78ee15275 197586 libimlib2-dev_1.4.7-1_amd64.deb Checksums-Sha256: c90df26860cb9020cf0996b1608111ac57918b4214993eb1c70756379f138e92 1996 imlib2_1.4.7-1.dsc 48e98337a560d8904f685447f41c43914fec1f8cd3745a9fd86cba9fd24a6563 1027716 imlib2_1.4.7.orig.tar.gz f60fe5544bad331e0c9dbb920f815ec2c423375e8803600d74c92f6e87b5b118 9456 imlib2_1.4.7-1.debian.tar.xz 948791d8b24e4b9ba25a537e749b555558475fe76a7ce813773418e97700e06b 202830 libimlib2_1.4.7-1_amd64.deb 7ecc08522013b1ce8d81daf5433864a0994a62c947332605b9e02236113fa855 197586 libimlib2-dev_1.4.7-1_amd64.deb Files: 26891df49e63959d5923d57c78ba4b58 1996 libs optional imlib2_1.4.7-1.dsc f5a1c06ce6e4656a04838a4db8c686b0 1027716 libs optional imlib2_1.4.7.orig.tar.gz f2920b537181acb40b60471bce4c4d91 9456 libs optional imlib2_1.4.7-1.debian.tar.xz 467a3c5aabe8968fbd98f7834dadf9f9 202830 libs optional libimlib2_1.4.7-1_amd64.deb 36371829a91d00c9f4f682178ed8bb33 197586 libdevel optional libimlib2-dev_1.4.7-1_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVMXkpAAoJEK+lG9bN5XPLiEwP/j4XgsFfDSGNWy7i6BS5BacH gt9CkHf2Gp+iwCM60eqRRZ0i9ebWpL5hpZEuPIINSaqE3SiXXftL69tqd7v+Q4J9 OM22euvzlxHYvS/XQl9r3Hi9EwU6Txcl3BWqN0TA98f5oDav/ysHKpknzV6I/rv/ ZIrlplSalxvAZTwy2EteHfUl9F3WxOOZzUc4xNKN8M492UjNZEeUqwWD7OGQjggg NLPYXtTG73JEqXT8RvoSyF7XYbU8NBhq4d0Wx+RFI5nElR5VfZMRMK7yjjCV9PlJ oF5JnyGfkOQj7ld5S9BRMfy+Hvx9cBJWJ2gqyVkFeDrfzKODc1O9lJ/QmcDOh80y uitQ+KXQ5DhL5obQ+XrQ+zzLEu2ewxaNEZ9xFAJDT9IaI0Dwi6NG2dtIxh178uSt htPARM+BGHGy3Uk+m6CJPX5ai2wsqi/RxfNm1cpVEaDOEKYnp3Z9e9F1YjMdDHQW TiilXZci3ThUf/bmTQ6OhHcxbXWssUpCN15d5Hgsjiff0jJ1P3mIme/VL+IRwk9K W90IOg1QQBxjxNSjQpZY7eVolx5P6OOFpCltkJNjhsJg0882lxIcdIoRzaQHVBNy k3MBM1YPTSQoVYVUidvvacV5kR+eThJ+3JledWlBtyDECIXLLVFvbI1fb/Bh390z xDf2lCyKUxyakaJadD5F =kIB8 -----END PGP SIGNATURE-----
--- End Message ---
