Bug#797165: CVE-2015-0852: integer overflow in PluginPCX.cpp
tags 797165 +patch thanks Could someone please check attached patch? Thanks. Description: fix integer overflow Origin: upstream http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginPCX.cpp?view=patch&r1=1.17&r2=1.18&pathrev=MAIN http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginPCX.cpp?view=patch&r1=1.18&r2=1.19&pathrev=MAIN Bug-Debian: https://bugs.debian.org/797165 Last-Update: 2015-09-14 --- This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ --- a/Source/FreeImage/PluginPCX.cpp +++ b/Source/FreeImage/PluginPCX.cpp @@ -347,12 +347,14 @@ try { // check PCX identifier - - long start_pos = io->tell_proc(handle); - BOOL validated = pcx_validate(io, handle); - io->seek_proc(handle, start_pos, SEEK_SET); - if(!validated) { - throw FI_MSG_ERROR_MAGIC_NUMBER; + // (note: should have been already validated using FreeImage_GetFileType but check again) + { + long start_pos = io->tell_proc(handle); + BOOL validated = pcx_validate(io, handle); + io->seek_proc(handle, start_pos, SEEK_SET); + if(!validated) { +throw FI_MSG_ERROR_MAGIC_NUMBER; + } } // process the header @@ -366,20 +368,38 @@ SwapHeader(&header); #endif - // allocate a new DIB + // process the window + const WORD *window = header.window; // left, upper, right,lower pixel coord. + const int left = window[0]; + const int top = window[1]; + const int right = window[2]; + const int bottom = window[3]; - unsigned width = header.window[2] - header.window[0] + 1; - unsigned height = header.window[3] - header.window[1] + 1; - unsigned bitcount = header.bpp * header.planes; - - if (bitcount == 24) { - dib = FreeImage_AllocateHeader(header_only, width, height, bitcount, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK); - } else { - dib = FreeImage_AllocateHeader(header_only, width, height, bitcount); + // check image size + if((left >= right) || (top >= bottom)) { + throw FI_MSG_ERROR_PARSING; } - // if the dib couldn't be allocated, throw an error + const unsigned width = right - left + 1; + const unsigned height = bottom - top + 1; + const unsigned bitcount = header.bpp * header.planes; + + // allocate a new DIB + switch(bitcount) { + case 1: + case 4: + case 8: +dib = FreeImage_AllocateHeader(header_only, width, height, bitcount); +break; + case 24: +dib = FreeImage_AllocateHeader(header_only, width, height, bitcount, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK); +break; + default: +throw FI_MSG_ERROR_DIB_MEMORY; +break; + } + // if the dib couldn't be allocated, throw an error if (!dib) { throw FI_MSG_ERROR_DIB_MEMORY; } @@ -426,19 +446,23 @@ if (palette_id == 0x0C) { BYTE *cmap = (BYTE*)malloc(768 * sizeof(BYTE)); - io->read_proc(cmap, 768, 1, handle); - pal = FreeImage_GetPalette(dib); - BYTE *pColormap = &cmap[0]; + if(cmap) { + io->read_proc(cmap, 768, 1, handle); - for(int i = 0; i < 256; i++) { - pal[i].rgbRed = pColormap[0]; - pal[i].rgbGreen = pColormap[1]; - pal[i].rgbBlue = pColormap[2]; - pColormap += 3; + pal = FreeImage_GetPalette(dib); + BYTE *pColormap = &cmap[0]; + + for(int i = 0; i < 256; i++) { + pal[i].rgbRed = pColormap[0]; + pal[i].rgbGreen = pColormap[1]; + pal[i].rgbBlue = pColormap[2]; + pColormap += 3; + } + + free(cmap); } - free(cmap); } // wrong palette ID, perhaps a gray scale is needed ? @@ -466,9 +490,9 @@ // calculate the line length for the PCX and the DIB // length of raster line in bytes - unsigned linelength = header.bytes_per_line * header.planes; + const unsigned linelength = header.bytes_per_line * header.planes; // length of DIB line (rounded to DWORD) in bytes - unsigned pitch = FreeImage_GetPitch(dib); + const unsigned pitch = FreeImage_GetPitch(dib); // run-length encoding ?
Processed: CVE-2015-0852: integer overflow in PluginPCX.cpp
Processing commands for cont...@bugs.debian.org: > tags 797165 +patch Bug #797165 [src:freeimage] CVE-2015-0852: integer overflow in PluginPCX.cpp Added tag(s) patch. > thanks Stopping processing here. Please contact me if you need assistance. -- 797165: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797165 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processing of ndisc6_1.0.1-4_source.changes
ndisc6_1.0.1-4_source.changes uploaded successfully to localhost along with the files: ndisc6_1.0.1-4.dsc ndisc6_1.0.1-4.debian.tar.xz Greetings, Your Debian queue daemon (running on host franck.debian.org)
ndisc6_1.0.1-4_source.changes ACCEPTED into unstable
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Mon, 14 Sep 2015 14:00:02 +0200 Source: ndisc6 Binary: ndisc6 ndisc6-udeb rdnssd rdnssd-udeb Architecture: source Version: 1.0.1-4 Distribution: unstable Urgency: medium Maintainer: Debian QA Group Changed-By: Santiago Vila Description: ndisc6 - IPv6 diagnostic tools ndisc6-udeb - IPv6 diagnostic tools (udeb) rdnssd - IPv6 recursive DNS server discovery daemon rdnssd-udeb - IPv6 recursive DNS server discovery daemon (udeb) Changes: ndisc6 (1.0.1-4) unstable; urgency=medium . * QA upload. * Refresh debian/patches/02-we-will-do-fine-without-build-date-or-build-host. The __DATE__ was still being used in rdnssd/rdnssd.c. Checksums-Sha1: 24047b4c588f4ec1d442c5f25590a33e0771a9f5 1590 ndisc6_1.0.1-4.dsc 780267fc8f81c942844484480b68668df5397b13 6612 ndisc6_1.0.1-4.debian.tar.xz Checksums-Sha256: 9fb80d48949b3560824862c4728f8f421c9111074e6e9ff93eea3a471642b967 1590 ndisc6_1.0.1-4.dsc a7bd3fd9360908ebe98fb4cbe13b4c7051ad63308e38414e0a38207f06ac5433 6612 ndisc6_1.0.1-4.debian.tar.xz Files: 6d9b4cae4af6dd0815a4369fa60063d7 1590 net optional ndisc6_1.0.1-4.dsc 33cb311d6e0b5fce4dfc92a033393dae 6612 net optional ndisc6_1.0.1-4.debian.tar.xz -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBCAAGBQJV9rbSAAoJEEHOfwufG4syJsIH/jSJJG6zo1HU0ud9aPwb/t/r +mmc2ua8ZV9CccLp1AwDzivljNJW8l+7Tdi8qR2x23ExVYjW91NTc5gJO869AJo3 Pq5P5pnbhGv16WEjR1L3PKPanNCl6pdnSaCVA45VP8UGUHcYEOSZHAaRd9/A0rP+ dX7NLE3SZ094a+eFMm2JevBAQVqJDfGRTdPYeh5nmRK/lGg3jKVeaPG9MkOOOeLC zO11ocNDzwx+m32SNhcLF/pWDAW2x6qLdMV2b3MWI7bQMH3fB4SMWj5uPg5PetcE QLmrVJCJEViYzumC/aSGajS/rp/wHgmM2YGzbbm9vgkbSOwEqxrZRgsZGlgXh3g= =K3k3 -END PGP SIGNATURE- Thank you for your contribution to Debian.
fet_5.27.9-1_amd64.changes ACCEPTED into unstable, unstable
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Sun, 13 Sep 2015 20:39:08 +0200 Source: fet Binary: fet fet-data Architecture: source all amd64 Version: 5.27.9-1 Distribution: unstable Urgency: medium Maintainer: Debian QA Group Changed-By: Gianfranco Costamagna Description: fet- timetable generator fet-data - timetable generator - documentation and examples Changes: fet (5.27.9-1) unstable; urgency=medium . * QA upload. . [ Gianfranco Costamagna ] * [a5cfe527] Imported Upstream version 5.27.9. * [efdd2302] Use the desktop file provided in upstream tarball. * [95c0483b] Simplify packaging a little bit, and add svg file. . [ Mattia Rizzolo ] * [9de377f1] debian/fet.menu: drop menu system. Checksums-Sha1: fef5f1997e52d5677a3b3a73d83a2d0ec752c953 1869 fet_5.27.9-1.dsc 62f2915c6080b854d7e97d5f475f75ff4d66f6ab 9717772 fet_5.27.9.orig.tar.bz2 9d0824009b12ca3e04bfe99e6bf1fe403e8f6e86 15880 fet_5.27.9-1.debian.tar.xz 5d7257e50850f66decb24d555cbaf7d20bfac398 3507924 fet-data_5.27.9-1_all.deb 274127dd60dad2844adda3987d4325b4a735d245 3202832 fet_5.27.9-1_amd64.deb Checksums-Sha256: 4ca1e934843320b760344acda1dcdfe71239b0e9618d0d8bfa47a0a89f65a2d2 1869 fet_5.27.9-1.dsc b12cd78df5f9d06104f3396a885dae5f04e64a667c2c6c89c8d6dfa57c18bee2 9717772 fet_5.27.9.orig.tar.bz2 b065a91283c505b821e64734a10920bd956e32a60e4dbecf77b82d1fece032d5 15880 fet_5.27.9-1.debian.tar.xz d502a080f208d246fb8874786397a1a28e6bb0b65c2f1da4ea513ff45f1fc3a1 3507924 fet-data_5.27.9-1_all.deb d86ea656532ab9cec1e524dccc069e23432805b331b2e68b6b758c8b25115e21 3202832 fet_5.27.9-1_amd64.deb Files: feb745d2cfcff03366d910645708ca89 1869 utils optional fet_5.27.9-1.dsc 179fae614a432ea8ce3586a3c1ee4054 9717772 utils optional fet_5.27.9.orig.tar.bz2 c685e6c9639e7bab8b0b42d383b2c8c6 15880 utils optional fet_5.27.9-1.debian.tar.xz 14e20b6c44544bdf34150bf2881776c7 3507924 utils optional fet-data_5.27.9-1_all.deb 282e17c554896625c34b1b63385cd5a3 3202832 utils optional fet_5.27.9-1_amd64.deb -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQIcBAEBCAAGBQJV9liGAAoJEPNPCXROn13ZtacQALqGYbQP3ble2Uh6IXNolO1j q4geEHjaSY6zk3HKl2DtTWW4oy46sD7whyostJvDzYsQmGngh+zrZB7h8JWV5VxH pobaum3bJwwxIDXHXPZrmU7Tl7hdmvAav8iO9TLcZ3f8sezBaKkdTKihkwwd+scQ N/4RRVFD1gVi9Igq8SujVnl5dSOacEXq2s3qZvUG6PHOzDjE/YgJ8+RTH7gyOKh2 SaFYDL4gAqRATShVrs0jAoxa/5guDZRMu2aoa7KjrazJHBoAS0t77R4bwfKDrc7d uvP9iDuXpp7HliFwDV7yFaXgdGyWEAPd/cwWIpB3DFww4jZv0b11J3MFoqcXEOTb jYOKeW12w0qB0pS+dXzu3WoarQcg+xQJimbKICTWAXYUMpzTlrV6VWp7IWMQIQjT 0mvAvRfBI/ur7U3mPpH3rs647YhEQroRtny/CEGf8K1LGyrleHpfvtMM2f3VYw3z GhyN7X4bdCo8PrNB9ur9ykOUhPMwVH/jInT5JA5jQLnFD3UMEOlPzB4wg4ZKJhD+ EwkdxuN5G7L4Bvg1C41XjXC4MIfAI5dotPkxfMw9HpQ5VxX2WscXAQPCz+X+SGH4 +FgfoPakrcIsdinCSFnxCCNx12bI/xuJWFMRW7F8t0pAIu2vZHFr6Xab+lKZymbz MlDFKJrFXevJwcBZHS34 =H1qi -END PGP SIGNATURE- Thank you for your contribution to Debian.
fet_5.27.8-1_amd64.changes ACCEPTED into unstable, unstable
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Sun, 06 Sep 2015 17:26:06 + Source: fet Binary: fet fet-data Architecture: source all amd64 Version: 5.27.8-1 Distribution: unstable Urgency: medium Maintainer: Debian QA Group Changed-By: Mattia Rizzolo Description: fet- timetable generator fet-data - timetable generator - documentation and examples Closes: 759227 759229 Changes: fet (5.27.8-1) unstable; urgency=medium . * QA upload. . [ Mattia Rizzolo ] * [d01f635] Imported Upstream version 5.27.8. Closes: #759229 * debian/control: + [4705a46] orphan the package. + [3853c59] bump Standards-Version to 3.9.6 (no changes needed). + [3ccf4d8] enlarge fet long description. + [f47de2d] add Vcs-{Git,Browser} fields. * [8b4188e] debian/source/format: add to set this package as 3.0 (quilt). * [c58242b] debian/{control,compat}: move to dh compat version 9. * [a2b1e22] debian/rules: rewrite using the dh sequencer. * [c54c88a,3eb8d2c,42081cb] split package in two binaries fet and fet-data. * [90ed97b] debian/fet.manpages: upstream changed paths + install fet-cl.1 * [6ac096e] debian/* run wrap-and-sort. * [b8be961] debian/copyright: rewrite following copyright format 1.0. . [ Petter Reinholdtsen ] * [2fe0435] debian/control: add the Homepage field. . [ Frank Cheung ] * [07c195f] debian/control: remove use of genetic algorithm in description. Closes: #759227, LP: #368017 . [ Garette Emmanuel ] * [481421b] debian/install: install the fet-cl binary (LP: #1404027). . [ Gianfranco Costamagna ] * [3b04629] debian/copyright: upstream moved from GPL-2+ to AGPL-2+ Checksums-Sha1: 9032709a83d727c97ae4648a15e76122de141b48 1869 fet_5.27.8-1.dsc 6631e7eff9ad6065a2f0850199d5d878862f039a 9719364 fet_5.27.8.orig.tar.bz2 f1bfd3a51bded04b6806f0156df5e83b495650e9 15984 fet_5.27.8-1.debian.tar.xz 3bc86e6808f7dd83ce188a3ef1d6664d23f9159f 3509314 fet-data_5.27.8-1_all.deb b97ad03a19aa1b784a0528f7ec564537b3259337 3210948 fet_5.27.8-1_amd64.deb Checksums-Sha256: 8c383a6593e8f59ba8fa7ea347e0f98f86e21941dae099fbafb50bc516af7013 1869 fet_5.27.8-1.dsc 687c9eb8df7aaa21a1cbfeb4837b74a18bbea03c920c067e1180ac738e1c39e9 9719364 fet_5.27.8.orig.tar.bz2 7e85eb8ff5157c0137b9acbb085e64798626867ec9449cad850e0a6f92a1c575 15984 fet_5.27.8-1.debian.tar.xz b0e78e93146984c9f13bb977bfb8120fe085f5af188ee4263d0441247bf0d473 3509314 fet-data_5.27.8-1_all.deb 1886c0ffc9e5d097580c3022c544cabe99839b16ae519c5127089762eeebb31e 3210948 fet_5.27.8-1_amd64.deb Files: 21e37dc53343e68e1626cdae4ea988e2 1869 utils optional fet_5.27.8-1.dsc 0d0dd66fc48f9cda486fcfc26c14f40d 9719364 utils optional fet_5.27.8.orig.tar.bz2 ca464ce28d5d31db51cd585dc45deaca 15984 utils optional fet_5.27.8-1.debian.tar.xz a433481b9acb2d78fca4bb7f0d84edc2 3509314 utils optional fet-data_5.27.8-1_all.deb 16d79533a538a711b7583975ef9b0f12 3210948 utils optional fet_5.27.8-1_amd64.deb -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQIcBAEBCAAGBQJV8VAdAAoJEPNPCXROn13ZBQIP+gPqmCq3/+i9zlYRwOw8DhQX csPWszuF75B2sq7w1TM3owLA4vdMIfKZNt5yhmlui6YNE7PPVMAlplQVtnvD0TWk X4wg03tucOdNjJlubZOLhgjXzjQEQjWpGs5zbloNd+VrkB6kguqcvbP7CgACMK7o yLJQowy+ksS40DFxS1CT+Zgc6yDl+3R4RlLLhIEciTahFWSDcdVFhlWk/+LaH6DD 43PVNjN4ZsN5xrCQ/mU6iGJwNhiXjQZhGtUNXjqVHRBJqCjwmJDM0OSWcSU+fuPI EdrvR3o5UorCD8ytHZxgkBHl82Vw84nj5c9LMWOXR6wY90JkcX+WlE15gyW/qGC/ K192m4PAk4JmBWff9CXTbYNDHGsx6MsMkyVTBp5OlyU70sqDgl4OnZjjpveSyfFr xGPYOygPtOKddh6vNxTzF/3QwyBsi1jxqIMDreJPx67Xt6aIMDtJsiv32EJ7SAsz rvmDNJbZXNzDaqVgNCNljya9QcAM/Vi2c6gNLJyAHWNyfZAP3IJr5WnpPgKd2If7 dCM6pel24SjJVzGN1BdG2QSpGstH0sWMEOfoyJXN+cGUHnphGPABWco2D+qIXsmT m+tSTsCOZnA9khV7REGAzGUmTsFS4112TQnzLsflZrisd1GbAPL8Y2Yb3UoZe/LP pV0xDh9CI8DCBACfPrcH =tE5V -END PGP SIGNATURE- Thank you for your contribution to Debian.
Bug#791582: (no subject)
Fix it in next uploud. pgpaDCI6qMrJ6.pgp Description: Assinatura digital OpenPGP
Bug#797165: freeimage: fixing CVE hints
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hello - Freeimage > 1.5.4 (that is, the current sid version) requires OpenJPEG 2.1.0, which is not in Debian. I wasted some time trying to make freeimage 1.7 work with openjpeg 1.5, but it's taking a bit too much time. At this moment, the best course of action may be to simply carry the new patches Raphael pointed out rather than updating freeimage then working to remove openjpeg 2.1 support. Just a hint, if you're ambitious, please don't let my comment stop you. -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJV9wT8AAoJEI7QYGkDfiTykTIP/2+mXufK8+v5FwaaYrC9DqUA dLIpLu8BzXvFNi7fxKSdeQ7TpccIUcRZPlijrSNC93spZgNmsfR98xtmUAcSC3W9 QqrUSSZOOr6Rn5vdWpHRpVZS2wYICnzGLX5AmPh+LpLXImAoWbu28d2vsU6GMAsN qWcH7NGuu/37iH5oMxBUuJ9y1Bgd7HruOl80O9SN+M9b90XxTiFIN2nCKAhtZxgv 8wldA2jCTgWX7mOW5Xd/mz0s+JJzlUiDjTj9xadSyrXSgR0JEE86mpCHs5uqJUZQ Ngje4+SffS2Z/PIycP3uv855N/nrinEMejHDaQ1o/GFIk4fymImZ6yB90Z2buU0y oKpVN0iaRcmGZcHycuBrGgvB6ev9wIlD4rzPlhHWFUJ9Kyadt8Gud6AfCAEDLF7n 99TvK86y2xL8pwj0RLqB3Yf0YV/Fp+5HZuG+qBgcJH8c9GGx9ZHhmzuboFJS/xTD L+4hJYYxiHP1n1uJ7NUN3ReOx4OmIJRHRwck5qfJCVMv+tQU+zHQ4H40/vfip07u j4dTz+t+TudWohHu2i7Fo5cFKE3Ec7n8bRYLHdp4nhn2d+3LSr27RER64fae8PWv PSmYsv7YumjhnqrETQrpmugqJziJnAA0VFW1OYQEZl/UQtXf5B75TDt9y27kEJ4H mLbU4ErFThcRv/rMNQDV =ojF1 -END PGP SIGNATURE-
Processing of fte_0.50.2b6-7_source.changes
fte_0.50.2b6-7_source.changes uploaded successfully to localhost along with the files: fte_0.50.2b6-7.dsc fte_0.50.2b6-7.debian.tar.xz Greetings, Your Debian queue daemon (running on host franck.debian.org)
fte_0.50.2b6-7_source.changes REJECTED
Source-only uploads to NEW are not allowed. === Please feel free to respond to this email if you don't understand why your files were rejected, or if you upload new files which address our concerns.
Processing of fte_0.50.2b6-7_amd64.changes
fte_0.50.2b6-7_amd64.changes uploaded successfully to localhost along with the files: fte_0.50.2b6-7.dsc fte_0.50.2b6-7.debian.tar.xz fte-console_0.50.2b6-7_amd64.deb fte-docs_0.50.2b6-7_all.deb fte-terminal_0.50.2b6-7_amd64.deb fte-xwindow_0.50.2b6-7_amd64.deb fte_0.50.2b6-7_amd64.deb Greetings, Your Debian queue daemon (running on host franck.debian.org)
Spécial Aïd Adha avec Dhia 2015
Si cet e-mail ne s'affiche pas correctement, Cliquez-ici Nous respectons votre vie privée, pour vous désabonner cliquez-ici
fte_0.50.2b6-7_amd64.changes is NEW
binary:fte-docs is NEW. Your package has been put into the NEW queue, which requires manual action from the ftpteam to process. The upload was otherwise valid (it had a good OpenPGP signature and file hashes are valid), so please be patient. Packages are routinely processed through to the archive, and do feel free to browse the NEW queue[1]. If there is an issue with the upload, you will recieve an email from a member of the ftpteam. If you have any questions, you may reply to this email. [1]: https://ftp-master.debian.org/new.html
Bug#765556: marked as done (fet: Please add homepage url in control file)
Your message dated Tue, 15 Sep 2015 06:59:08 +0100 with message-id <1442296748.79553.bpmail_high_carr...@web171802.mail.ir2.yahoo.com> and subject line has caused the Debian Bug report #765556, regarding fet: Please add homepage url in control file to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 765556: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765556 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: fet Version: 5.18.0-1 Tags: patch Severity: wishlist Please add a homepage URL in the debian/control file to make it easier to visit the upstream project page. The upstream URL is http://www.lalescu.ro/liviu/fet/ >. --- debian/control.orig 2014-10-16 09:22:11.677885204 +0200 +++ debian/control 2014-10-16 09:22:24.849996264 +0200 @@ -4,6 +4,7 @@ Maintainer: Radu Spineanu Build-Depends: debhelper (>= 7.0.0), libqt4-dev, qt4-dev-tools Standards-Version: 3.9.5 +Homepage: http://www.lalescu.ro/liviu/fet/ Package: fet Architecture: any -- Happy hacking Petter Reinholdtsen --- End Message --- --- Begin Message --- closing--- End Message ---