oss-sec mailing list archives

Re: Re: librsvg and cairo are causing libpng to write out-of-bounds

From: Gustavo Grieco <gustavo.grieco () gmail com>
Date: Wed, 26 Oct 2016 19:00:23 -0300

A patch was recently proposed:

https://bugs.freedesktop.org/attachment.cgi?id=127421

thanks to John Bowler and his detailed analysis of this issue:

https://bugs.freedesktop.org/show_bug.cgi?id=98165

Can we have a CVE, now that we know it was an integer overflow and we have
a patch?

Regards,
Gustavo.


2016-10-06 21:02 GMT-03:00 John Bowler <john.cunningham.bowler () gmail com>:

The bug is not specific to librsvg.  This instance happens in
write_png inside cairo-png.c, but the actual bug is elsewhere.  Other
exploits probably exist using things other than PNG and SVG.  I think
this needs to be CVE'ed immediately.

--
John Bowler <john.cunningham.bowler () gmail com>
+1 (541) 450-9885
PO BOX 3151
KERBY OR 97531-3151
USA

Current thread:

librsvg and cairo are causing libpng to write out-of-bounds Gustavo Grieco (Oct 05)
- Re: librsvg and cairo are causing libpng to write out-of-bounds Glenn Randers-Pehrson (Oct 06)
- <Possible follow-ups>
- Re: librsvg and cairo are causing libpng to write out-of-bounds John Bowler (Oct 06)
  - Re: Re: librsvg and cairo are causing libpng to write out-of-bounds Gustavo Grieco (Oct 26)
    - Re: librsvg and cairo are causing libpng to write out-of-bounds cve-assign (Oct 26)