505a70edbe
Fixes the following security vulnerablities: - CVE-2018-1000222: Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free - CVE-2018-5711: gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function - CVE-2019-11038: When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code - CVE-2019-6978: The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
81 lines
2.4 KiB
Diff
81 lines
2.4 KiB
Diff
From ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 Mon Sep 17 00:00:00 2001
|
|
From: Mike Frysinger <vapier@gentoo.org>
|
|
Date: Sat, 14 Jul 2018 13:54:08 -0400
|
|
Subject: [PATCH] bmp: check return value in gdImageBmpPtr
|
|
|
|
Closes #447.
|
|
|
|
CVE-2018-1000222
|
|
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
src/gd_bmp.c | 17 ++++++++++++++---
|
|
1 file changed, 14 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/gd_bmp.c b/src/gd_bmp.c
|
|
index bde0b9d..78f40d9 100644
|
|
--- a/src/gd_bmp.c
|
|
+++ b/src/gd_bmp.c
|
|
@@ -47,6 +47,8 @@ static int bmp_read_4bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
|
|
static int bmp_read_8bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp_hdr_t *header);
|
|
static int bmp_read_rle(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info);
|
|
|
|
+static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression);
|
|
+
|
|
#define BMP_DEBUG(s)
|
|
|
|
static int gdBMPPutWord(gdIOCtx *out, int w)
|
|
@@ -87,8 +89,10 @@ BGD_DECLARE(void *) gdImageBmpPtr(gdImagePtr im, int *size, int compression)
|
|
void *rv;
|
|
gdIOCtx *out = gdNewDynamicCtx(2048, NULL);
|
|
if (out == NULL) return NULL;
|
|
- gdImageBmpCtx(im, out, compression);
|
|
- rv = gdDPExtractData(out, size);
|
|
+ if (!_gdImageBmpCtx(im, out, compression))
|
|
+ rv = gdDPExtractData(out, size);
|
|
+ else
|
|
+ rv = NULL;
|
|
out->gd_free(out);
|
|
return rv;
|
|
}
|
|
@@ -141,6 +145,11 @@ BGD_DECLARE(void) gdImageBmp(gdImagePtr im, FILE *outFile, int compression)
|
|
compression - whether to apply RLE or not.
|
|
*/
|
|
BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
|
|
+{
|
|
+ _gdImageBmpCtx(im, out, compression);
|
|
+}
|
|
+
|
|
+static int _gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
|
|
{
|
|
int bitmap_size = 0, info_size, total_size, padding;
|
|
int i, row, xpos, pixel;
|
|
@@ -148,6 +157,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
|
|
unsigned char *uncompressed_row = NULL, *uncompressed_row_start = NULL;
|
|
FILE *tmpfile_for_compression = NULL;
|
|
gdIOCtxPtr out_original = NULL;
|
|
+ int ret = 1;
|
|
|
|
/* No compression if its true colour or we don't support seek */
|
|
if (im->trueColor) {
|
|
@@ -325,6 +335,7 @@ BGD_DECLARE(void) gdImageBmpCtx(gdImagePtr im, gdIOCtxPtr out, int compression)
|
|
out_original = NULL;
|
|
}
|
|
|
|
+ ret = 0;
|
|
cleanup:
|
|
if (tmpfile_for_compression) {
|
|
#ifdef _WIN32
|
|
@@ -338,7 +349,7 @@ cleanup:
|
|
if (out_original) {
|
|
out_original->gd_free(out_original);
|
|
}
|
|
- return;
|
|
+ return ret;
|
|
}
|
|
|
|
static int compress_row(unsigned char *row, int length)
|
|
--
|
|
2.20.1
|
|
|