Package: libimlib2
Version: 1.4.8-1
Tags: security
imlib2 crashes when loading the attached file:
$ debian/tmp/usr/bin/imlib2_conv overflow.pbm /dev/null
*** Error in `debian/tmp/usr/bin/imlib2_conv': double free or corruption
(out): 0x575e4ce8 ***
Valgrind says it's a heap-based buffer overflow:
Invalid write of size 4
at 0x484DF7C: load (loader_pnm.c:175)
by 0x4860B16: imlib_save_image (api.c:4606)
by 0x108939: main (imlib2_conv.c:76)
Address 0x4dd4828 is 0 bytes after a block of size 64 alloc'd
at 0x482E27C: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
by 0x484DBC7: load (loader_pnm.c:149)
by 0x4860B16: imlib_save_image (api.c:4606)
by 0x108939: main (imlib2_conv.c:76)
Found using american fuzzy lop:
http://lcamtuf.coredump.cx/afl/
-- System Information:
Architecture: i386
Versions of packages libimlib2 depends on:
ii libbz2-1.0 1.0.6-8.1
ii libc6 2.24-12
ii libfreetype6 2.8-0.2
ii libgif7 5.1.4-0.4
ii libid3tag0 0.15.1b-12
ii libjpeg62-turbo 1:1.5.1-2
ii libpng16-16 1.6.30-2
ii libtiff5 4.0.8-3
ii libx11-6 2:1.6.4-3
ii libxext6 2:1.3.3-1+b2
ii zlib1g 1:1.2.8.dfsg-5
--
Jakub Wilk
