Bug 1306681 (CVE-2013-7447)
Summary: | CVE-2013-7447 gtk2, gtk3: Integer overflow in image handling | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | anemec, ccecchi, mclasen, otte, slawomir |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-03-14 06:21:57 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1306682, 1306683 | ||
Bug Blocks: | 1306685 |
Description
Adam Mariš
2016-02-11 15:04:25 UTC
Created gtk2 tracking bugs for this issue: Affects: fedora-all [bug 1306682] Created gtk3 tracking bugs for this issue: Affects: fedora-all [bug 1306683] This is basically a DoS flaw when opening a crafted image. When g_malloc() is asked to malloc huge amount of memory, and it is unable to do it, it crashes with a g_error() amount similar to: (eog:18754): GLib-ERROR **: /build/buildd/glib2.0-2.36.0/./glib/gmem.c:165: failed to allocate 18446744071914584320 bytes Also it looks like gtk3 is not affected by this flaw, since the code there is completely different. In gdk_cairo_set_source_pixbuf() rather than doing: cairo_pixels = g_malloc (height * cairo_stride); and creating a "surface" after that by using cairo_image_surface_create_for_data() what gtk3 does is that it uses the cairo function cairo_surface_create_similar_image() to create the surface. cairo_surface_create_similar_image() uses pixman_image_create() which calculates the size of the buffer needed to hold the image. pixman_image_create() handles it correctly by using the following code: pixels = FbPixelsCreate (width, height, format->depth); if (pixels == NULL) return NULL; |