[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1609090953070.18405@freddy.simplesystems.org>
Date: Fri, 9 Sep 2016 09:56:49 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: Agostino Sarubbo <ago@...too.org>
cc: oss-security@...ts.openwall.com
Subject: Re: GraphicsMagick 1.3.25 fixes some security
issues
On Fri, 9 Sep 2016, Agostino Sarubbo wrote:
> On Tuesday 06 September 2016 20:50:23 Bob Friesenhahn wrote:
>> 4. The TIFF reader had a bug pertaining to use of TIFFGetField() when
>> a 'count' value is returned. The bug caused a heap read overflow (due
>> to using strlcpy() to copy a possibly unterminated string) which could
>> allow an untrusted file to crash the software.
>
>
> For who is interested, the details of the issue N° 4 are documented here:
>
> https://blogs.gentoo.org/ago/2016/08/23/graphicsmagick-two-heap-based-buffer-overflow-in-readtiffimage-tiff-c/[1]
The problem was due to the definition of strlcpy() in that it is
supposed to return the number of characters which would have been
copied if the destination buffer was large enough. To satisfy this
requirement, strlcpy() needs to continue scanning memory until it
encounters a null byte in memory.
The strlcpy() function has very nice properties but this weakness is
something that developers need to be aware of.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
