oss-sec mailing list archives
librsvg and cairo are causing libpng to write out-of-bounds
From: Gustavo Grieco <gustavo.grieco () gmail com>
Date: Wed, 5 Oct 2016 22:43:19 -0300
Hello, We found a write out-of-bounds affecting librsvg 2.40 and cairo 1.14.6 (but other versions could be affected). It was tested in ArchLinux (x86_64). In this odd issue, the interaction between librsvg and cairo is somehow causing the function png_write_row in libpng to write out of bounds. To reproduce: $ gdb --args rsvg-convert -o /dev/null libpng-crash.svg ... Thread 1 "rsvg-convert" received signal SIGSEGV, Segmentation fault. 0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007ffff6753e1e in __memmove_sse2_unaligned_erms () from /usr/lib/libc.so.6 #1 0x00007ffff423cce8 in png_write_row () from /usr/lib/libpng16.so.16 #2 0x00007ffff423d0ab in png_write_image () from /usr/lib/libpng16.so.16 #3 0x00007ffff7046455 in ?? () from /usr/lib/libcairo.so.2 #4 0x00007ffff7046e09 in cairo_surface_write_to_png_stream () from /usr/lib/libcairo.so.2 #5 0x00000000004021c6 in ?? () #6 0x00007ffff66f0291 in __libc_start_main () from /usr/lib/libc.so.6 #7 0x0000000000402a49 in ?? () I don't think there is bug in libpng, but i'm not sure where the other libraries are failing. Interestingly enough, there is no indication of invalid memory reads or writes before the crash. The compressed reproducer is attached. Hopefully someone will be able to find and isolate this vulnerability. Regards, Gustavo.
Attachment:
libpng-crash.svg.gz
Description:
Current thread:
- librsvg and cairo are causing libpng to write out-of-bounds Gustavo Grieco (Oct 05)
- Re: librsvg and cairo are causing libpng to write out-of-bounds Glenn Randers-Pehrson (Oct 06)
- <Possible follow-ups>
- Re: librsvg and cairo are causing libpng to write out-of-bounds John Bowler (Oct 06)
- Re: Re: librsvg and cairo are causing libpng to write out-of-bounds Gustavo Grieco (Oct 26)
- Re: librsvg and cairo are causing libpng to write out-of-bounds cve-assign (Oct 26)
- Re: Re: librsvg and cairo are causing libpng to write out-of-bounds Gustavo Grieco (Oct 26)