[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1811231930580.16715@scrappy.simplesystems.org>
Date: Fri, 23 Nov 2018 19:33:55 -0600 (CST)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Crashes and memory safety bugs in dcraw
On Fri, 23 Nov 2018, Ian Zimmerman wrote:
> An important side note: because dcraw intentionally doesn't provide a
> library, only an executable, code from it is bundled in at least some
> applications that use it; thus updating the dcraw package in a distro
> will not by itself be the end of this problem for the distro. One such
> application : RawTherapee
GraphicsMagick also bundles some version of dcraw for its Microsoft
Windows builds. It is executed as an external program so if it
becomes corrupted, it will not corrupt the invoking application.
Another consideration is that the dcraw author has huge sample image
archive that he is only willing to sell for private use. This means
that other projects (including those which derived code from dcraw)
might not work correctly with as many input files since they have not
done as much validation.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
