Bug 1198171 (CVE-2015-2158)

Summary:	CVE-2015-2158 pngcrush: pngcrush_measure_idat() off-by-one error
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	contribs, jrusnack, nphilipp
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pngcrush 1.7.84	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-06 14:55:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1198174, 1198175
Bug Blocks:	1198177

Description Vasyl Kaigorodov 2015-03-03 13:50:35 UTC

A crash potentially leading to code execution was reported [1] and fixed [2] in pngcrush version 1.7.84.
Upstream commit that fixes this:
http://sourceforge.net/p/pmt/code/ci/a1ce646d00a400fd9ec321ab5cb522f40b7bdfe6/

[1]: http://seclists.org/oss-sec/2015/q1/709
[2]: http://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/

Comment 1 Vasyl Kaigorodov 2015-03-03 13:53:31 UTC

Created pngcrush tracking bugs for this issue:

Affects: fedora-all [bug 1198174]
Affects: epel-all [bug 1198175]

Comment 2 Stefan Cornelius 2015-03-06 14:55:18 UTC

This is an off-by-one error in the "pngcrush_measure_idat()" function in pngcrush.c, introduced by commit http://sourceforge.net/p/pmt/code/ci/e1a36a9639e2db16494d90459c7c2b78677a20bf/ in version 1.7.83.

The code in pngcrush line 7405:
if (length < 28)
   for (ib=27; ib >= length; ib--) 
      buff[ib] = 0;

If length is 0, the last iteration will set "ib" to -1, thus buff[ib] = 0; will write outside of the "buff" buffer. I doubt that this can be exploited for anything else than an application crash.

Statement:

This issue did not affect the versions of pngcrush as shipped with Red Hat Enterprise Linux 7.