[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20160630121425.GA17822@eldamar.local>
Date: Thu, 30 Jun 2016 14:14:25 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: CVE Request: libgd: Invalid color index is
not properly handled leading to denial of service (crash)
Hi,
On Wed, Jun 29, 2016 at 09:27:58PM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > There is currently PHP upstream bug which is still marked as private:
> >
> > https://bugs.php.net/bug.php?id=72494
> >
> > But the libgd project references the following set of commits to this
> > bug report:
> >
> > https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae
> >
> > indicating that libgd does not properly handle invalid color index,
> > which could lead to a denial of service against applications using the
> > libgd library (in particular thus PHP).
>
> > https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
> > gd_crop.c
> > gdImageCropThreshold
> >
> > + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
> > + return NULL;
> > + }
>
> > https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96
> > tests/gdimagecrop/php_bug_72494.c
> >
> > im = gdImageCreate(50, 50);
> > gdImageCropThreshold(im, 1337, 0);
> > gdImageDestroy(im);
>
> Use CVE-2016-6128.
Thanks for the CVE assignment. Just for the record, my above commit
range stated should have better been written as
https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd
including
https://github.com/libgd/libgd/commit/a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
