Package: xzgv Version: 0.8-5 Severity: grave Tags: security patch Hi,
recently an exploitable buffer overflow was discovered in xzgv, please see here for some details and some further URLs: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1060 Please mention the CVE number in the changelog when you fix this to ease tracking. I attach a test case jpg, and the patch from upstream. Thank you! Martin -- Martin Pitt http://www.piware.de Ubuntu Developer http://www.ubuntu.com Debian Developer http://www.debian.org In a world without walls and fences, who needs Windows and Gates?
--- xzgv-0.8-patched/src/readjpeg.c Tue Mar 21 12:16:07 2006
+++ xzgv/src/readjpeg.c Wed Sep 21 21:15:01 2005
@@ -179,11 +179,13 @@
static int have_image;
static int width,height;
static unsigned char *image;
+static int cmyk;
unsigned char *ptr,*ptr2;
int chkw,chkh;
int f,rec;
static int greyscale; /* static to satisfy gcc -Wall */
+cmyk=0;
greyscale=0;
lineptrs=NULL;
@@ -225,6 +227,15 @@
greyscale=1;
}
+if(cinfo.jpeg_color_space==JCS_CMYK)
+ cmyk=1;
+
+if(cinfo.jpeg_color_space==JCS_YCCK)
+ {
+ cmyk=1;
+ cinfo.out_color_space=JCS_CMYK;
+ }
+
*wp=width=cinfo.image_width;
*hp=height=cinfo.image_height;
@@ -266,7 +277,7 @@
/* this one shouldn't hurt */
cinfo.do_block_smoothing=FALSE;
-if(WH_BAD(width,height) || (*imagep=image=malloc(width*height*3))==NULL)
+if(WH_BAD(width,height) || (*imagep=image=malloc(width*(height+cmyk)*3))==NULL)
longjmp(jerr.setjmp_buffer,1);
jpeg_start_decompress(&cinfo);
@@ -279,12 +290,33 @@
for(f=0;f<height;f++,ptr+=width*3)
lineptrs[f]=ptr;
-rec=cinfo.rec_outbuf_height;
-while(cinfo.output_scanline<height)
+if(!cmyk)
{
- f=height-cinfo.output_scanline;
- jpeg_read_scanlines(&cinfo,lineptrs+cinfo.output_scanline,
- f>rec?rec:f);
+ rec=cinfo.rec_outbuf_height;
+ while(cinfo.output_scanline<height)
+ {
+ f=height-cinfo.output_scanline;
+ jpeg_read_scanlines(&cinfo,lineptrs+cinfo.output_scanline,
+ f>rec?rec:f);
+ }
+ }
+else /* cmyk output */
+ {
+ int tmp;
+
+ ptr=image;
+ while(cinfo.output_scanline<height)
+ {
+ jpeg_read_scanlines(&cinfo,&ptr,1);
+ ptr2=ptr;
+ for(f=0;f<width;f++,ptr+=3,ptr2+=4)
+ {
+ tmp=ptr2[3];
+ ptr[0]=(tmp*ptr2[0])/255;
+ ptr[1]=(tmp*ptr2[1])/255;
+ ptr[2]=(tmp*ptr2[2])/255;
+ }
+ }
}
free(lineptrs);
<<attachment: xzgv.CVE-2006-1060.jpg>>
signature.asc
Description: Digital signature
