Your message dated Mon, 29 Oct 2018 13:04:00 +0000 with message-id <[email protected]> and subject line Bug#854367: fixed in apng2gif 1.8-0.1 has caused the Debian Bug report #854367, regarding apng2gif: CVE-2017-6960: Integer overflow resulting in heap buffer overflow to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 854367: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854367 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: apng2gif Version: 1.7-1 Severity: important Dear Maintainer, Q.) What led up to the situation? A.) In load_apng function, the imagesize variable is prone to integer overflow vulnerability (It is basically calculated from w and h variables which are in the hands of the user input). And then frameRaw.p and frameCur.p are assigned an lower amount of memory because of this vulnerability which will result in unallocated memory pointers in frameRaw.rows and frameCur.rows whose dereference can cause heap buffer overflow read/write. Q.) What exactly did you do (or not do) that was effective (or ineffective)? A.) Just have to modify the relavent offsets in the png file so that the h and w variables can result in an overflow of the imagesize variable. Steps to reproduce: Use the makefile in the attachment and compile the program to get the program in asan mode. Use the input.png file in the attachment as input to the program and run it: apng2gif input.png Q.) What was the outcome of this action? A.) Heap buffer overflow read at memcpy in the if condition bop==0 in compose_frame function for example. But theoretically, This can result in an heap overflow write in some memcpy too under specific conditions. Sample ASAN Output: apng2gif 1.7 Reading './crashes_submitted/integeroverflow/input.png'... ================================================================= ==16318== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb57ff8ff at pc 0x804a7e2 bp 0xbfe89908 sp 0xbfe898fc READ of size 1 at 0xb57ff8ff thread T0 #0 0x804a7e1 (apng2gif/1.7/gccasanbuild/apng2gif+0x804a7e1) #1 0x80582bb (apng2gif/1.7/gccasanbuild/apng2gif+0x80582bb) #2 0x804938b (apng2gif/1.7/gccasanbuild/apng2gif+0x804938b) #3 0xb5e2baf2 (/lib/i386-linux-gnu/libc-2.19.so+0x19af2) #4 0x804a0c1 (apng2gif/1.7/gccasanbuild/apng2gif+0x804a0c1) 0xb57ff8ff is located 255 bytes to the right of 67375104-byte region [0xb17be800,0xb57ff800) allocated by thread T0 here: #0 0xb61006a4 (/usr/lib/i386-linux-gnu/libasan.so.0.0.0+0x116a4) #1 0x805626a (apng2gif/1.7/gccasanbuild/apng2gif+0x805626a) #2 0x804938b (apng2gif/1.7/gccasanbuild/apng2gif+0x804938b) #3 0xb5e2baf2 (/lib/i386-linux-gnu/libc-2.19.so+0x19af2) Shadow bytes around the buggy address: 0x36affec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36affed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36affee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36affef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x36afff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x36afff10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] 0x36afff20:fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36afff30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36afff40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36afff50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36afff60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap righ redzone: fb Freed Heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==16318== ABORTING Q.) What outcome did you expect instead? A.) Maybe some check to see if each pointer in frameRaw.rows/frameCur.rows is less than or equal to frameCur.p + imagesize before trying to dereference them. Or may be something to get rid of interger overflow in the first place -- System Information: Debian Release: jessie/sid APT prefers trusty-updates APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty'), (100, 'trusty-backports') Architecture: i386 (i686) Kernel: Linux 3.13.0-32-generic (SMP w/2 CPU cores)PACKAGE = apng2gif CC = gcc CFLAGS = -Wall -g3 -pedantic -fno-omit-frame-pointer -fsanitize=address CFLAGS_OPT = -O3 LIBS = -lstdc++ -lm -lpng -lz all : $(CC) $(CFLAGS) $(CFLAGS_OPT) -o apng2gif apng2gif.cpp $(LIBS) ..PHONY : clean clean : rm -rf apng2gif
--- End Message ---
--- Begin Message ---Source: apng2gif Source-Version: 1.8-0.1 We believe that the bug you reported is fixed in the latest version of apng2gif, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Reiner Herrmann <[email protected]> (supplier of updated apng2gif package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 27 Oct 2018 14:15:49 +0200 Source: apng2gif Binary: apng2gif Architecture: source Version: 1.8-0.1 Distribution: unstable Urgency: medium Maintainer: Jari Aalto <[email protected]> Changed-By: Reiner Herrmann <[email protected]> Description: apng2gif - tool for converting APNG images to animated GIF format Closes: 854367 854441 854447 Changes: apng2gif (1.8-0.1) unstable; urgency=medium . * Non-maintainer upload. * New upstream release. - Fixes CVE-2017-6960 (Closes: #854367). - Fixes CVE-2017-6961 (Closes: #854441). - Fixes CVE-2017-6962 (Closes: #854447). Checksums-Sha1: 2d6fdc91c41949e7c1707f4f2a1e70c1d43b059f 1886 apng2gif_1.8-0.1.dsc f1f24e5ece9b6880334ba218c5ff7dadf91aedda 437914 apng2gif_1.8.orig.tar.gz d34cc6d4258909a473752a88eb04405f404f5f22 6724 apng2gif_1.8-0.1.debian.tar.xz 69f724c185a3620421d84967dee31f72c77f5df3 5548 apng2gif_1.8-0.1_powerpc.buildinfo Checksums-Sha256: e43a8f19ddced85f005478ea8c7be96f202622328d23bd3c90554d9e78fb0679 1886 apng2gif_1.8-0.1.dsc 4d47a2c0e6656bbc5afeecccc62b22f885a6b0434944bd52824126a156959649 437914 apng2gif_1.8.orig.tar.gz 8592fc133ea42694c79cfffa5ad31526cb8ab0c0045f1552e246757fd9a1e0be 6724 apng2gif_1.8-0.1.debian.tar.xz 5e66e72e7073d06871e3793f22c3396df687ce6f63919e4d826ce2e6c6fa43ef 5548 apng2gif_1.8-0.1_powerpc.buildinfo Files: 839d4f7f3f0d2a869484e53b0f6de19b 1886 graphics optional apng2gif_1.8-0.1.dsc 4cf980234840ce2aa856cf328c644e85 437914 graphics optional apng2gif_1.8.orig.tar.gz 50b9332ec64e1541522fe109244f8d61 6724 graphics optional apng2gif_1.8-0.1.debian.tar.xz eaa7b7aac0edb69c1d1fdda722e916a0 5548 graphics optional apng2gif_1.8-0.1_powerpc.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAlvUXCQACgkQxCxY61kU kv1JaRAAsFYXg6vhnRAqwdnRYkr1OTBbmm4fsjglS4I/fzixylAXQdpGHNakbrkb YWjxuOpPwefVzOF15o++MGunIRQMO4C0DBFah6Qf4Ioz+Wtx8Lmo6d/TZKG2R80X 7ekCOSgmE5SDkl+xfY0RrJqTTY8bLkhsplzaQsY/fyyf3isRCbkkhOZRfSWOCewa Zft8c8U9lUVmKgGyh5AP3keJDVhgZiuU2buDswUq2VTsuQaBTwyXIICGWbIWjE0u F0ayKvzCQKgWTHg8PSAY4m884/DyDupEofHxfYuzSp5rH4iEk4O24oJuCv6vnKyg r1M4kiauBW0arqW4H/u4J5yKmywXxrppXRYQ+O3eu9y6sC3Vxee0rZgtNgv7GPTP EBJik9qHLuB34TmDi5ynAx96QjQkvutMHTZsF6dksSkyasoVZ217UaL/9glAqrVN 4DvE0c6TrLsP4HTySatZJfoEze1NigJPrO9k1m5C6TEV/gKZfKXneba7IRcGxPNE cApUjza56COd7MG2x82XpnI+vGCZChU8gVde3VnKUTLJAXJxa9tjg/zmdgtMi3GS V5yYNYTkDY9NKzOF7vpSxRQgna0RXSg6XkMM77b/OEaxL217/Xeg6nwXrlsucCN4 mfIZm1rg9DsIBdMAvuIByMLNg6lD111OnSerGNvMmTMU0PUuabM= =kXuG -----END PGP SIGNATURE-----
--- End Message ---
