Hi, On Tue, Jun 16, 2015 at 06:26:31AM +0200, Salvatore Bonaccorso wrote: > Hi, > > A second CVE was assigned for a further issue: > > http://www.openwall.com/lists/oss-security/2015/06/16/4 > (CVE-2015-4588).
Attached debdiff fixes the two CVEs on squeeze-lts. Since sid,jessie and wheezy ship basically the same versions it should easily apply there as well. With the patches applied I couldn't reproduce the crashes anymore as descibed at: http://seclists.org/oss-sec/2015/q2/597 I'd appreciate any comments / reviews before releasing the DLA. Cheers, -- Guido
diff --git a/debian/changelog b/debian/changelog index b130ed9..bd3b0f0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,14 @@ +libwmf (0.2.8.4-6.2+deb6u1) squeeze-lts; urgency=medium + + * CVE-2015-4588: Add RLE Decoding check + Fix taken from Redhat BZ + https://bugzilla.redhat.com/show_bug.cgi?id=1227243 + * CVE-2015-0848: Only DecodeImage if pixel is one byte + Fix taken from Redhat BZ + https://bugzilla.redhat.com/show_bug.cgi?id=1227243 + + -- Guido Günther <a...@sigxcpu.org> Fri, 19 Jun 2015 13:48:03 +0200 + libwmf (0.2.8.4-6.1) unstable; urgency=high * Non-maintainer upload. diff --git a/src/ipa/ipa.h b/src/ipa/ipa.h index d050a7e..3003540 100644 --- a/src/ipa/ipa.h +++ b/src/ipa/ipa.h @@ -48,7 +48,7 @@ static int ReadBlobByte (BMPSource*); static unsigned short ReadBlobLSBShort (BMPSource*); static unsigned long ReadBlobLSBLong (BMPSource*); static long TellBlob (BMPSource*); -static void DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*); +static int DecodeImage (wmfAPI*,wmfBMP*,BMPSource*,unsigned int,unsigned char*); static void ReadBMPImage (wmfAPI*,wmfBMP*,BMPSource*); static int ExtractColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned int,unsigned int); static void SetColor (wmfAPI*,wmfBMP*,wmfRGB*,unsigned char,unsigned int,unsigned int); diff --git a/src/ipa/ipa/bmp.h b/src/ipa/ipa/bmp.h index 29eee34..7751a36 100644 --- a/src/ipa/ipa/bmp.h +++ b/src/ipa/ipa/bmp.h @@ -859,7 +859,7 @@ static long TellBlob (BMPSource* src) % % */ -static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels) +static int DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int compression,unsigned char* pixels) { int byte; int count; int i; @@ -870,12 +870,14 @@ static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int com U32 u; unsigned char* q; + unsigned char* end; for (u = 0; u < ((U32) bmp->width * (U32) bmp->height); u++) pixels[u] = 0; byte = 0; x = 0; q = pixels; + end = pixels + bmp->width * bmp->height; for (y = 0; y < bmp->height; ) { count = ReadBlobByte (src); @@ -884,7 +886,10 @@ static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int com { /* Encoded mode. */ byte = ReadBlobByte (src); for (i = 0; i < count; i++) - { if (compression == 1) + { + if (q == end) + return 0; + if (compression == 1) { (*(q++)) = (unsigned char) byte; } else @@ -896,13 +901,15 @@ static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int com else { /* Escape mode. */ count = ReadBlobByte (src); - if (count == 0x01) return; + if (count == 0x01) return 1; switch (count) { case 0x00: { /* End of line. */ x = 0; y++; + if (y >= bmp->height) + return 0; q = pixels + y * bmp->width; break; } @@ -910,13 +917,20 @@ static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int com { /* Delta mode. */ x += ReadBlobByte (src); y += ReadBlobByte (src); + if (y >= bmp->height) + return 0; + if (x >= bmp->width) + return 0; q = pixels + y * bmp->width + x; break; } default: { /* Absolute mode. */ for (i = 0; i < count; i++) - { if (compression == 1) + { + if (q == end) + return 0; + if (compression == 1) { (*(q++)) = ReadBlobByte (src); } else @@ -943,7 +957,7 @@ static void DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int com byte = ReadBlobByte (src); /* end of line */ byte = ReadBlobByte (src); - return; + return 1; } /* @@ -1143,8 +1157,18 @@ static void ReadBMPImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src) } } else - { /* Convert run-length encoded raster pixels. */ - DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image); + { + if (bmp_info.bits_per_pixel == 8) /* Convert run-length encoded raster pixels. */ + { + if (!DecodeImage (API,bmp,src,(unsigned int) bmp_info.compression,data->image)) + { WMF_ERROR (API,"corrupt bmp"); + API->err = wmf_E_BadFormat; + } + } + else + { WMF_ERROR (API,"Unexpected pixel depth"); + API->err = wmf_E_BadFormat; + } } if (ERR (API))