imlib2: CVE-2011-5326: divide-by-zero on 2x1 ellipse

Debian Bug report logs - #639414
imlib2: CVE-2011-5326: divide-by-zero on 2x1 ellipse

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Kevin Ryde <user42@zip.com.au>

To: submit@bugs.debian.org

Subject: libimlib2: divide-by-zero on 2x1 ellipse

Date: Sat, 27 Aug 2011 09:41:08 +1000

[Message part 1 (text/plain, inline)]

Package: libimlib2
Version: 1.4.4-1
Severity: normal

Attempting to draw a 2x1 radii ellipse with imlib_image_draw_ellipse()
per foo.c below gets a SIGFPE floating point exception.

It seems happy enough to draw 1x1, 1x2 and 2x2, but not 2x1.

(The "convert" in the program is from imagemagick, just a handy way to
see the png as text.)

[foo.c (text/x-csrc, inline)]

#include <stdio.h>
#include <stdlib.h>
#include <Imlib2.h>

int
main (void)
{
  Imlib_Image im;
  Imlib_Load_Error err;

  im = imlib_create_image(10,10);
  imlib_context_set_image(im);
  imlib_context_set_anti_alias(0);

  imlib_image_draw_ellipse (4,4, 2,1);

  imlib_image_set_format("png");
  imlib_save_image_with_error_return("/tmp/x.png", &err);
  if (err != 0) {
    printf ("save error %d\n", err);
  } else {
    system("convert /tmp/x.png /tmp/x.xpm && cat /tmp/x.xpm");
  }
  exit(0);
}

[Message part 3 (text/plain, inline)]

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (990, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-486
Locale: LANG=en_AU, LC_CTYPE=en_AU (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash

Versions of packages libimlib2 depends on:
ii  libbz2-1.0              1.0.5-6          high-quality block-sorting file co
ii  libc6                   2.13-10          Embedded GNU C Library: Shared lib
ii  libfreetype6            2.4.4-2          FreeType 2 font engine, shared lib
ii  libgif4                 4.1.6-9          library for GIF images (library)
ii  libid3tag0              0.15.1b-10       ID3 tag reading library from the M
ii  libjpeg62               6b1-2            Independent JPEG Group's JPEG runt
ii  libpng12-0              1.2.46-3         PNG library - runtime
ii  libtiff4                3.9.5-1          Tag Image File Format (TIFF) libra
ii  libx11-6                2:1.4.3-2        X11 client-side library
ii  libxext6                2:1.3.0-3        X11 miscellaneous extension librar
ii  zlib1g                  1:1.2.3.4.dfsg-3 compression library - runtime

libimlib2 recommends no packages.

libimlib2 suggests no packages.

-- no debconf information

Message #12 received at 639414@bugs.debian.org (full text, mbox, reply):

From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>

To: 639414@bugs.debian.org

Subject: Re: libimlib2: divide-by-zero on 2x1 ellipse

Date: Fri, 1 Apr 2016 00:08:12 +0300

[Message part 1 (text/plain, inline)]

control tags -1 patch upstream security
thanks

I tested against current jessie/sid versions, they are still affected.
Attached patch plugs SIGFPE, but probably produces incorrect images.
I'd like to note that this bug has minor security implications (DoS for 
applications that issue draw command based on untrusted input).

[fix-ellipse-div-by-zero-2.patch (text/x-patch, attachment)]

Message #19 received at 639414@bugs.debian.org (full text, mbox, reply):

From: Simon Lees <sflees@suse.de>

To: 639414@bugs.debian.org

Subject: Re: libimlib2: divide-by-zero on 2x1 ellipse

Date: Wed, 6 Apr 2016 10:40:43 +0930

[Message part 1 (text/plain, inline)]

Hi

Attached is a better patch, dx / dy are slowly decrementing so cutting
them of at 1 seems reasonable. These variables combined with xx and yy
are only used to work out if x or y has changed since the last iteration
then increment or decrement the other variables and continue the loop.
From looking at the first loop In the case where b == 0, dx and dy will
always be 0 as well in which case the loop won't run due to dy < dx. As
dy is incremented by b*b and dx is decremented by a*a to replicate this
issue a*a*b - a*a == 0, in other words when b == 1. Presuming this is
implementing 1 of 2 common ellipse drawing algorithms we are probably
talking about drawing ellipses that are either 1 or 2 pixels high and
were probably never going to draw that well anyway.

-- 

Simon Lees (Simotek)                            http://simotek.net

Emergency Update Team                           keybase.io/simotek
SUSE Linux                            Adeliade Australia, UTC+9:30
GPG Fingerprint: 5B87 DB9D 88DC F606 E489 CEC5 0922 C246 02F0 014B

[imlib2-ellipse-div-by-0.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #24 received at 639414@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Kevin Ryde <user42@zip.com.au>, 639414@bugs.debian.org

Subject: Re: Bug#639414: libimlib2: divide-by-zero on 2x1 ellipse

Date: Sun, 10 Apr 2016 19:34:05 +0200

Control: tags -1 + fixed-upstream

Hi,

This has been addressed upstream with:
https://git.enlightenment.org/legacy/imlib2.git/commit/?id=c94d83ccab15d5ef02f88d42dce38ed3f0892882

Regards,
Salvatore

Message #33 received at 639414-close@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: 639414-close@bugs.debian.org

Subject: Bug#639414: fixed in imlib2 1.4.8-1

Date: Sat, 23 Apr 2016 12:49:20 +0000

Source: imlib2
Source-Version: 1.4.8-1

We believe that the bug you reported is fixed in the latest version of
imlib2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 639414@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alessandro Ghedini <ghedo@debian.org> (supplier of updated imlib2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 Apr 2016 13:39:26 +0100
Source: imlib2
Binary: libimlib2 libimlib2-dev
Architecture: source amd64
Version: 1.4.8-1
Distribution: unstable
Urgency: high
Maintainer: Alessandro Ghedini <ghedo@debian.org>
Changed-By: Alessandro Ghedini <ghedo@debian.org>
Description:
 libimlib2  - image loading, rendering, saving library
 libimlib2-dev - image loading, rendering, saving library (development files)
Closes: 639414 785369 819818 821732
Changes:
 imlib2 (1.4.8-1) unstable; urgency=high
 .
   * New upstream release
   * Fix divide-by-zero on 2x1 ellipse as per CVE-2011-5326 (Closes: #639414)
   * Fix off-by-one OOB read as per CVE-2016-3993 (Closes: #819818)
   * Fix out-of-bounds read in the GIF loader as per CVE-2016-3994
     (Closes: #785369)
   * Fix integer overflow as per CVE-2016-4024 (Closes: #821732)
   * Refresh patches
   * Update symbols file
   * Update Vcs links
   * Bump Standards-Version to 3.9.8 (no changes needed)
   * Fix spelling-error-in-description
Checksums-Sha1:
 5a93832dbb9e35b20f42602500f71379e32cc7e5 2006 imlib2_1.4.8-1.dsc
 982ffe64592a6b075f4ba5ffe9dd92266c505d9c 1028562 imlib2_1.4.8.orig.tar.gz
 a66a763f0ba7ac3cca51adabb52a9c5ce9af54d5 11628 imlib2_1.4.8-1.debian.tar.xz
 8d2fc19ec788163673356063a700eee727b05318 421696 libimlib2-dbgsym_1.4.8-1_amd64.deb
 5a5fa3ce51a9ec60cb998e06482181e8f8903f64 196926 libimlib2-dev_1.4.8-1_amd64.deb
 421cca802a98e9d574cc84b54489d81bdcedaa25 204620 libimlib2_1.4.8-1_amd64.deb
Checksums-Sha256:
 027d47ccd8b40f830274880abe78cd639d778dbe7e9b9503fa546a1c8f1c419c 2006 imlib2_1.4.8-1.dsc
 b5b97be5446d9c5635c288bfe970896148d8bc027ab01f854112cae03b65a3a5 1028562 imlib2_1.4.8.orig.tar.gz
 211fed683ebc77d1f91c229e27bbce1ef0d88aea17a6584a324ad82ec1d013df 11628 imlib2_1.4.8-1.debian.tar.xz
 9f9d0f4a3507eec042b8ddaae47a0cfe92398d45cebfdca641d6de62a6372a5b 421696 libimlib2-dbgsym_1.4.8-1_amd64.deb
 13e996c8e4ede7693cbb6eea696c0e305ae519af1720fcb1851a7ec5dea19bd5 196926 libimlib2-dev_1.4.8-1_amd64.deb
 a9cee479608e93ea0305c9b8ed3509568a5c909b0cc4b9cfbde8403c9f0a4b7b 204620 libimlib2_1.4.8-1_amd64.deb
Files:
 8c6322245baee7ccfe52cc694449bc2a 2006 libs optional imlib2_1.4.8-1.dsc
 2e9d5054022945ed14935d5f61fc2145 1028562 libs optional imlib2_1.4.8.orig.tar.gz
 cd78bae35929765c7866a4c40e851580 11628 libs optional imlib2_1.4.8-1.debian.tar.xz
 b433b107a6f9a679ba7bd6a8b98f723f 421696 debug extra libimlib2-dbgsym_1.4.8-1_amd64.deb
 a44ea04aabd60cc48e99f69341a3ab8c 196926 libdevel optional libimlib2-dev_1.4.8-1_amd64.deb
 da86fe35fb1d6d910211499838fd5fbb 204620 libs optional libimlib2_1.4.8-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXG23NAAoJEK+lG9bN5XPLb8UP/RbVATo6bEVOAJKJEGa5PvHg
ZLp8bh75K1w6CnZFkgsLYdumLQ7lI4V5yLrqdqi5HTbMtX2gsyEZpAWFXfEqGpGY
v+pnMelWPYGqPjvHs2r2451oeeLf6Lzqnoj8+fGR8LhQ9NI8Zp0PPBl/4xYsZnFu
IghCHk+iUNU//EkTcPa8plTuc4OCdv+jD88w2BE8o6UpWZqglAfLm+Z0aWdTszvg
bxlfJoo2sMQ1X68d0ACQzmr9DDvKf1c2wDjQrZNyxLYRMrsN+sJEgh+g0iY1NqOl
ZV1GP6ZbBazOYkkfR9Dw/+b+N/aPMKdGU+t0yChH6cJJcXPcGgrWR+4b6Ia1yM5S
cOoAcH9KR4SUU+Ih4uRjk4AVv37qHr/A2KB4CxIKWWXdMflZ4zjZONkGZP0ZRKzD
FgNUwWZVYQ3M4OQ8LS3P3023e2b98IyrYDTIpJBSHNHOmKpOSMOnHyXH391zOzx9
vOiBVqII8DvcfhfBCqX7S5jlQ2niWBjRrh946c9ZdMZJJQUEpaNyBsN42t1fQAzq
xVVzah8LkbR37AJpiZdfvy2wY5qz4FQs29Ypbeu1SFOrUi0L+Ig2gvCEiVFeVZls
W3EGG7GhCHmOmhaCoPY3fDiGG6ftmU+S1DINMuuAJx2ohCJoWktXwObR066xOolP
7kCgUphtazOcojYlGSh/
=eoRm
-----END PGP SIGNATURE-----

Message #38 received at 639414-close@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: 639414-close@bugs.debian.org

Subject: Bug#639414: fixed in imlib2 1.4.6-2+deb8u2

Date: Sun, 24 Apr 2016 16:17:08 +0000

Source: imlib2
Source-Version: 1.4.6-2+deb8u2

We believe that the bug you reported is fixed in the latest version of
imlib2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 639414@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alessandro Ghedini <ghedo@debian.org> (supplier of updated imlib2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 Apr 2016 17:21:25 +0100
Source: imlib2
Binary: libimlib2 libimlib2-dev
Architecture: source amd64
Version: 1.4.6-2+deb8u2
Distribution: jessie-security
Urgency: high
Maintainer: Alessandro Ghedini <ghedo@debian.org>
Changed-By: Alessandro Ghedini <ghedo@debian.org>
Description:
 libimlib2  - image loading, rendering, saving library
 libimlib2-dev - image loading, rendering, saving library (development files)
Closes: 639414 785369 819818 820206 821732
Changes:
 imlib2 (1.4.6-2+deb8u2) jessie-security; urgency=high
 .
   * Fix divide-by-zero on 2x1 ellipse as per CVE-2011-5326 (Closes: #639414)
   * Fix integer overflow as per CVE-2014-9771 (Closes: #820206)
   * Fix off-by-one OOB read as per CVE-2016-3993 (Closes: #819818)
   * Fix out-of-bounds read in the GIF loader as per CVE-2016-3994
     (Closes: #785369)
   * Fix integer overflow as per CVE-2016-4024 (Closes: #821732)
Checksums-Sha1:
 7470354709a3d7be00b7167dfceb804ee46333ce 2024 imlib2_1.4.6-2+deb8u2.dsc
 a2482f66d66769fa36e6f3de7ec59c457ae67300 13808 imlib2_1.4.6-2+deb8u2.debian.tar.xz
 f99d69589a9dea8edabd3f1f3723d4738bbda80e 178094 libimlib2_1.4.6-2+deb8u2_amd64.deb
 581a0354099e5031d0f605459bb5b41402770557 171020 libimlib2-dev_1.4.6-2+deb8u2_amd64.deb
Checksums-Sha256:
 d912082e80c1e5e01e1a8133f798177fd6dcd97b29cfa66b1fc3a4b7707b367e 2024 imlib2_1.4.6-2+deb8u2.dsc
 14cf3fc71964d3d2399abc8166b775e2d150d3c4102f736270a4c528a19480a3 13808 imlib2_1.4.6-2+deb8u2.debian.tar.xz
 744136e9b44f76e61cf3aad4135da0368cb386fe4c022c720e82d414726b4f8a 178094 libimlib2_1.4.6-2+deb8u2_amd64.deb
 0b852d7b22748a0b53d510272d1037f556b65a1f19fb5baeb7da376637c38b5e 171020 libimlib2-dev_1.4.6-2+deb8u2_amd64.deb
Files:
 5a98c6da18fe01d668d49074147df1f7 2024 libs optional imlib2_1.4.6-2+deb8u2.dsc
 82a1d5e1d4827ab64b15ad1b38f20aab 13808 libs optional imlib2_1.4.6-2+deb8u2.debian.tar.xz
 d435a22396557ca7ae311f15103ea71d 178094 libs optional libimlib2_1.4.6-2+deb8u2_amd64.deb
 4dcaa20ec5088cbbc8bd0c0045109b7f 171020 libdevel optional libimlib2-dev_1.4.6-2+deb8u2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXG6gHAAoJEK+lG9bN5XPLInQP/212i3fZEXxFCaDt87RvJeZl
7Mg9yJqv0JVNcCr1CZR8UFYYIgDS8UHr8HjEX8JQibPn/YJkkUMzIcrCCWhC4h94
vHGLZYQJFz++zEDWaPi0dsQQEcMMO4wtRmO+SIcoBo53bxDcHpXQjdT5B5bM04/e
V1gXYGzwJz5swGCd50Lw160+BPee7Qcjq4ngcam4nZA/v8Eb2Rz2DvenXUTLmybP
zshAb93Oo1KyytC+16AuLInC91QYf/5E5rhEL6FYQIoy/yIaL35NdpxHGAI3wpb7
ZRY6WSRQCNlX/ROMlHG5X9JfErlQD4xHrvkzuZH48xGv2EjF4M0afrztZN8RtyWF
8v0y4tpGwUl+KYrIQlt5usPDYR8EXmywP4Zk9aMOd/hof8hSsQ4NSGUT3i5QIMOd
VTRoOI1A1ApseBgwkqOmlQ2eyi7GXIOYmh9B09hrjnUmM86eXQhfMUjC4WK7k18I
6i5LU9kyvw48ORqD5DeQxHfkl/mBmwIsXHl9TbgoNLrtxvxhrUEuzlXqA/rORRnv
bgq0iit9oOsozwEW0DsFzPksG+kauPVM405X9GPrdEAAN/jQwRNxkhjVUKz4vM7p
x9tQSyOtWeI6sog8txP31RAo44rbV/fK6NZs//9yjw0yvlTtyFfn+xUu6OghRYjX
uLVCkOLlujZXy1M3Y3Zh
=HD8L
-----END PGP SIGNATURE-----

Message #43 received at 639414-close@bugs.debian.org (full text, mbox, reply):

From: Alessandro Ghedini <ghedo@debian.org>

To: 639414-close@bugs.debian.org

Subject: Bug#639414: fixed in imlib2 1.4.5-1+deb7u2

Date: Mon, 25 Apr 2016 22:19:34 +0000

Source: imlib2
Source-Version: 1.4.5-1+deb7u2

We believe that the bug you reported is fixed in the latest version of
imlib2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 639414@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alessandro Ghedini <ghedo@debian.org> (supplier of updated imlib2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 Apr 2016 17:45:34 +0100
Source: imlib2
Binary: libimlib2 libimlib2-dev
Architecture: source amd64
Version: 1.4.5-1+deb7u2
Distribution: wheezy-security
Urgency: high
Maintainer: Laurence J. Lane <ljlane@debian.org>
Changed-By: Alessandro Ghedini <ghedo@debian.org>
Description: 
 libimlib2  - powerful image loading and rendering library
 libimlib2-dev - Imlib2 development files
Closes: 639414 785369 819818 820206 821732
Changes: 
 imlib2 (1.4.5-1+deb7u2) wheezy-security; urgency=high
 .
   * Fix divide-by-zero on 2x1 ellipse as per CVE-2011-5326 (Closes: #639414)
   * Fix integer overflow as per CVE-2014-9771 (Closes: #820206)
   * Fix off-by-one OOB read as per CVE-2016-3993 (Closes: #819818)
   * Fix out-of-bounds read in the GIF loader as per CVE-2016-3994
     (Closes: #785369)
   * Fix integer overflow as per CVE-2016-4024 (Closes: #821732)
Checksums-Sha1: 
 cad4c183388f29468d5c49fe1c814398fef0522a 1905 imlib2_1.4.5-1+deb7u2.dsc
 e425aecfda30d1560c6f3d4ae54b219d1e2308ad 13141 imlib2_1.4.5-1+deb7u2.debian.tar.gz
 87075df86ab13c6110a76e7352c467218e09e3d5 258882 libimlib2_1.4.5-1+deb7u2_amd64.deb
 04c7f1cdb10162a479d4a5b7f8ddb76ec20c921c 253156 libimlib2-dev_1.4.5-1+deb7u2_amd64.deb
Checksums-Sha256: 
 5ec1bcaa808ef24b09e5a8bf68ad4fbf336b078c9dfc019b49c6ce619a0bd74a 1905 imlib2_1.4.5-1+deb7u2.dsc
 a9bb6851b54b6c295718f44c9a16f0b7a6b1291c9fc6bc2b2f97454ff14d21c4 13141 imlib2_1.4.5-1+deb7u2.debian.tar.gz
 5719f093cdd785903c349b1dd129705a7accff210fd842da548d265c9c9ca66f 258882 libimlib2_1.4.5-1+deb7u2_amd64.deb
 a483fb6c50178dff14fe5be8bbbb69d69cc0d997c8ad1a03871d997ccc0e0316 253156 libimlib2-dev_1.4.5-1+deb7u2_amd64.deb
Files: 
 8068c0cdaac9bc87c1932d4a6cbc5621 1905 libs optional imlib2_1.4.5-1+deb7u2.dsc
 4aff721f0fbc1addbe68949812566e85 13141 libs optional imlib2_1.4.5-1+deb7u2.debian.tar.gz
 0b507f3301d223dd0f17328981c385e7 258882 libs optional libimlib2_1.4.5-1+deb7u2_amd64.deb
 667e42ae4ce9b18cd88a3bff421ef96f 253156 libdevel optional libimlib2-dev_1.4.5-1+deb7u2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXG6e8AAoJEK+lG9bN5XPLDRsP/11g/hzTfo//OJKJeXH0ATG7
LKy/YhGKFoeOog+mSSTI+NEd7mNO4uUMFLw2zhWwnzyQiMrYUm1sZbPOrzscbqGV
OqXulb+T4xOYtVB1/twZRUr4jVroAFB1yM1kV6Uc/yzVIciY5f5WA0GGRZ3KwECH
D9bYZTjtvVlFeOdA3EkS/ML02S9RNNXQu0HvM0JF5XID4p3kBeVpOZO1C08gNCCZ
O52BBNTcYWVPumzWkp6kZnc+6iyecH8UKcVavKqejtdulLabeVUyi6gT2CRDdWy8
NN8CRDKa+CqiXyveroLDa6RoNkXZwIOEWHL+4rEM4Hf2zyGvZFbLvkBK9bQZhXSj
WcXl2Cn8QU1ENvvkiRU8JG/L8NoDwjfzetxLwjV3izJ0w9gNbYjTsjPCDiCE9Pi+
lilxfc23FXhCLkC1RzIxSNpkx+xk6EW5mXZlN1aGcfdcL1Ni4LvwPFl3X4yXyzYN
kvKgQWjmSgn/N1oCtkEcxdluPr4Q77M0Qb5KV5SGoqhl2/zT2fmk6QSoNiHFUTAI
OoGiSiJ87flXmMznp/eF6haL7Qo4818xYq5gg4pzJBVZ8JzE2OgIa8lNbkI5E9ZI
YgtHP2S5ElJhpqqoJ6GvNPEz0pGENRDDij0D03dSQ7avR+a3jNBexfiGpWgWMgOr
sFlOaCiPH7gtjVb4PYCa
=fXu6
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.