Your message dated Wed, 07 Mar 2018 21:05:42 +0000
with message-id <e1etgfq-000eke...@fasolo.debian.org>
and subject line Bug#773968: fixed in imlib2 1.5.0-1
has caused the Debian Bug report #773968,
regarding feh hangs on invalid bmp images
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
773968: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773968
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: feh
Version: 2.12-1
Severity: normal

Feh hangs in an infinite loop when given invalid bmp images in
a mode that should help determining if the image can be displayed (-U
command line argument). I did run feh on a afl[1]-generated image test
sets[2] to figure out if any specific images cause problems for
feh. If you try feh with following command line parameters on the
attached images (after extracting them from a tarball), you should see
timeouts:

$ for image in *.bmp; do echo "$image"; timeout -s KILL 10s feh -U "$image"; 
done
id:000774,src:000207,op:arith8,pos:22,val:-28.bmp
Killed
id:000784,src:000207,op:havoc,rep:32.bmp
Killed
id:000787,src:000207,op:havoc,rep:16,+cov.bmp
Killed
id:000955,src:000787,op:flip2,pos:28.bmp
Killed
id:000972,src:000800,op:flip1,pos:60,+cov.bmp
Killed
id:000984,src:000800,op:havoc,rep:32.bmp
Killed
id:001091,src:000972,op:flip2,pos:18.bmp
Killed
id:001092,src:000972,op:arith8,pos:22,val:-25.bmp
Killed
id:001093,src:000972,op:arith8,pos:22,val:-29.bmp
Killed
id:001097,src:000980,op:arith8,pos:18,val:-3.bmp
Killed
id:001154,src:001098,op:flip1,pos:172.bmp
Killed
id:001155,src:001098,op:flip1,pos:172.bmp
Killed
id:001157,src:001098,op:havoc,rep:4.bmp
Killed
id:001159,src:001098,op:havoc,rep:4.bmp
Killed
id:001263,src:001155,op:flip1,pos:178.bmp
Killed
id:001264,src:001155,op:int32,pos:177,val:+1024,+cov.bmp
Killed

Attached a tarball that includes all BMP images generated by afl that
cause an infinite loop in feh.

[1]: American fuzzy lop - a security-oriented fuzzer:
     http://lcamtuf.coredump.cx/afl/
[2]: Afl-generated, minimized image test sets:
     http://lcamtuf.coredump.cx/afl/demo/

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (990, 'testing'), (100, 'unstable'), (99, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages feh depends on:
ii  libc6         2.19-13
ii  libcurl3      7.38.0-3
ii  libexif12     0.6.21-2
ii  libimlib2     1.4.6-2+b3
ii  libpng12-0    1.2.50-2+b2
ii  libx11-6      2:1.6.2-3
ii  libxinerama1  2:1.1.3-1+b1

Versions of packages feh recommends:
ii  libjpeg-progs  1:9a-2

feh suggests no packages.

-- no debconf information

Attachment: afl-hanging-bmp-images.tar.gz
Description: application/gzip


--- End Message ---
--- Begin Message ---
Source: imlib2
Source-Version: 1.5.0-1

We believe that the bug you reported is fixed in the latest version of
imlib2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 773...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <a...@debian.org> (supplier of updated imlib2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 07 Mar 2018 18:29:16 +0100
Source: imlib2
Binary: libimlib2 libimlib2-dev
Architecture: source
Version: 1.5.0-1
Distribution: unstable
Urgency: medium
Maintainer: Markus Koschany <a...@debian.org>
Changed-By: Markus Koschany <a...@debian.org>
Description:
 libimlib2  - image loading, rendering, saving library
 libimlib2-dev - image loading, rendering, saving library (development files)
Closes: 773968 868151
Changes:
 imlib2 (1.5.0-1) unstable; urgency=medium
 .
   * New upstream version 1.5.0.
   * Move the repository to salsa.debian.org.
   * Drop bug-868177-invalid-free.patch. Applied upstream.
   * Add FTBFS_X11_SHM_FD.patch and fix FTBFS when HAVE_X11_SHM_FD is not
     defined.
   * Add bug-868151.patch. Fix potential use of uninitialized value. Thanks to
     Jakub Wilk for the report and Kim Woelders for the patch. (Closes: #868151)
   * Update debian/libimlib2.symbols for new release.
   * Add bug-773968.patch and fix infinite loop with invalid bmp images. Thanks
     to Jussi Judin for the report and Kim Woelders for the patch.
     (Closes: #773968)
Checksums-Sha1:
 4599dd99f863214c8077f7fc1fa133e3fcaca4d5 2183 imlib2_1.5.0-1.dsc
 8ec9c2dd1b216f0d6cf933a47b27d70551acaf90 450808 imlib2_1.5.0.orig.tar.xz
 d4181b9dfe2363a7f51c1642916590b9832ac450 11320 imlib2_1.5.0-1.debian.tar.xz
 6d437d3580d4b3600de74d9e06289ab4ccbc7341 7158 imlib2_1.5.0-1_amd64.buildinfo
Checksums-Sha256:
 d17da932187bc6edf36d918b6d18312b060d2fee81099e018c85454f30a1027c 2183 
imlib2_1.5.0-1.dsc
 22b445610b23dda5c7e20b232463792bf2d08c50539c0bc29bc83e6dbc2b934d 450808 
imlib2_1.5.0.orig.tar.xz
 347547878d388fbe17c83b2e80c29bb2ed0dd5ee4f31e36de28bb1f9847e26a9 11320 
imlib2_1.5.0-1.debian.tar.xz
 d21f806efcf4484a80c8829be4f5df08c73a52b29611fa8ed779dac0bdc23731 7158 
imlib2_1.5.0-1_amd64.buildinfo
Files:
 4937e0fdc3745a9a9c09a6d041be002c 2183 libs optional imlib2_1.5.0-1.dsc
 09b2328df5417f207cea4eb3d0bb2282 450808 libs optional imlib2_1.5.0.orig.tar.xz
 3666805a6c3ea36e2a122435813073ec 11320 libs optional 
imlib2_1.5.0-1.debian.tar.xz
 0f43350579829c2ae7f035c5d1a51a2f 7158 libs optional 
imlib2_1.5.0-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlqgRhNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkVVAP/RT4RB++KsKBYIgfM5kpjgHa9kRTaNTNSCuF
DUfj+Uu0UOl4cxsmOaMZ6TeKJe2HgZadvwJ3m6pNRiOxBkQq2p2WcRGE3y9tyqDm
q3+IRBKOVUCyIqA0pCVyyFESmVDDxLKASXtMJDeNbJeIr9MYgfPVWMzjNYrHSY3r
CDsNlQGKL6/tvuVbe6cooZ8tjNwzA+zE8U17w5wmJtYmrBrMgYVF7PzxvUP+yU3S
NTx32BjVsBKuCedRqizGqyNnHhD/IUa7yzrFQBGYjZufQUQoNUpb4RphV2CSaYug
JaTqMMsQexW6X02OOdIAONJEGWcCzaNfGP3MmovX6oON8DYTrQu7OStVGlPfXyap
x7g/Yt5f6f+Hg/sCAa5CLbcqSJLuIyFcqrZ+FTXboia48iN5FVwTY4abwa/26g1R
VZPRDal6XDFAz75DIMmum8kxJlKAe9YobeQ9T5d1SycucQnkcW+yZ4jJewsfSdOh
413F/G8Z0FI3yX4nszmEDlpt1yR7Bi8+va2z1jpQggbtb1Ejpy0as74o1TBPhPX5
wx6OLA41WHt21SVBeckIsQ6ShjJ7vAQmdbRiy0FnWv5olBef+dETjK4rPV6FVPvW
l0EnzZHNRv3eqBf0BU1YpSJenf7jc5dDx6a0k/BS8HIQATRTfXogmDZqaHBFdUFx
WhpLGkiU
=BXam
-----END PGP SIGNATURE-----

--- End Message ---

Reply via email to