gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file

Debian Bug report logs - #832496
gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gdk-pixbuf: ico loader crashes when loading crafted file ico loader crashes when loading crafted file

Date: Tue, 26 Jul 2016 06:30:56 +0200

Source: gdk-pixbuf
Version: 2.31.1-1
Severity: important
Tags: security upstream
Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=769170

>From upstream bug report, and since there is no CVE assigned, for
better trackability:

> There's a crash when loading specially crafted ico files.
> 
> See http://seclists.org/oss-sec/2016/q3/61
> 
> I have reproduced this with 2.30.7, 2.31.1 and 2.35.2. It doesn't
> happen with 2.26.1. It's easily reproducible with tests/pixbuf-read.
> 
> Here's the backtrace for 2.35.2:
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff54ea414 in OneLine32 (context=0x611f50) at io-ico.c:596
> 596                Pixels[X * 4 + 0] = context->LineBuf[X * 4 + 2];
> (gdb) bt
> #0  0x00007ffff54ea414 in gdk_pixbuf__ico_image_load_increment (context=0x611f50) at io-ico.c:596
> #1  0x00007ffff54ea414 in gdk_pixbuf__ico_image_load_increment (context=0x611f50) at io-ico.c:807
> #2  0x00007ffff54ea414 in gdk_pixbuf__ico_image_load_increment (data=0x611f50, buf=0x60fc52 "", size=0, error=0x7fffffffe438) at io-ico.c:898
> #3  0x00007ffff7bc4695 in gdk_pixbuf_loader_load_module (loader=loader@entry=0x60f400 [GdkPixbufLoader], image_type=image_type@entry=0x0, error=error@entry=0x7fffffffe438) at gdk-pixbuf-loader.c:443
> #4  0x00007ffff7bc4f20 in gdk_pixbuf_loader_close (loader=loader@entry=0x60f400 [GdkPixbufLoader], error=error@entry=0x7fffffffe488)
>     at gdk-pixbuf-loader.c:808
> #5  0x0000000000400ac6 in main (err=0x7fffffffe488, len=70, bytes=0x60cdf0 "") at pixbuf-read.c:35
> #6  0x0000000000400ac6 in main (argc=<optimized out>, argv=<optimized out>) at pixbuf-read.c:75

Regards,
Salvatore

Message #20 received at 832496-submitter@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: control@bugs.debian.org

Cc: 832496-submitter@bugs.debian.org

Subject: closing 832496

Date: Fri, 23 Dec 2016 02:00:14 +0100

close 832496 2.36.2-1
thanks

Message #25 received at 832496@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 832496@bugs.debian.org

Cc: Michael Biebl <biebl@debian.org>, pkg-gnome-maintainers@lists.alioth.debian.org

Subject: Re: Processed: closing 832496

Date: Fri, 23 Dec 2016 06:45:29 +0100

Control: fixed -1 2.35.4-1

On Fri, Dec 23, 2016 at 01:03:05AM +0000, Debian Bug Tracking System wrote:
> Processing commands for control@bugs.debian.org:
> 
> > close 832496 2.36.2-1
> Bug #832496 [src:gdk-pixbuf] gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file
> Marked as fixed in versions gdk-pixbuf/2.36.2-1.
> Bug #832496 [src:gdk-pixbuf] gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file
> Marked Bug as done

Actually, unless my research is wrong the first fixing version is
2.35.4-1.

Let me know if that's wrong please.

Regards,
Salvatore

Message #32 received at 832496@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 832496@bugs.debian.org

Subject: Re: Processed: closing 832496

Date: Fri, 23 Dec 2016 22:04:58 +0100

[Message part 1 (text/plain, inline)]

Am 23.12.2016 um 06:45 schrieb Salvatore Bonaccorso:
> Control: fixed -1 2.35.4-1
> 
> On Fri, Dec 23, 2016 at 01:03:05AM +0000, Debian Bug Tracking System wrote:
>> Processing commands for control@bugs.debian.org:
>>
>>> close 832496 2.36.2-1
>> Bug #832496 [src:gdk-pixbuf] gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file
>> Marked as fixed in versions gdk-pixbuf/2.36.2-1.
>> Bug #832496 [src:gdk-pixbuf] gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file
>> Marked Bug as done
> 
> Actually, unless my research is wrong the first fixing version is
> 2.35.4-1.
> 
> Let me know if that's wrong please.

I just tested the current version in unstable and didn't research the
correct version. Thanks for caring and fixing it.


Regards,
Michael

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.