Bug 1311882 (CVE-2014-9766)

Summary: CVE-2014-9766 pixman: integer overflow in create_bits function
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ajax, alonbl, bmcclain, carnil, cfergeau, dblechte, dmoppert, erik-fedora, fedora-mingw, gklein, kem, kseifried, lsurette, mgoldboi, michal.skrivanek, rbalakri, rh-spice-bugs, rjones, sherold, srevivo, virt-maint, ykaul, ylavi
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-05 02:20:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 972647    
Bug Blocks: 1312311    

Description Andrej Nemec 2016-02-25 09:26:31 UTC
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.

External references:


CVE assignment:


Comment 1 Doran Moppert 2016-06-10 00:56:36 UTC
Updated affects list for RHEL components.

Not affected because they already have the patch:

Not affected because the guard is _pixman_multiply_overflows_int which
matches the type of each operand and thus the result of the multiplication:

Removed from whiteboard because these packages don't appear to exist in
current manifests:

Ping Kurt - not sure if I'm treating rhev-m correctly or looking in the
right places to audit.

Comment 5 Kurt Seifried 2016-06-10 16:09:09 UTC
What info is needed?

Comment 8 Doran Moppert 2016-07-05 02:17:38 UTC
Based on assertions from Mozilla that they believe their products only use the affected code in a safe context (with bounded width & height), and testing with firefox and thunderbird that has failed to disprove this assertion, I am marking Firefox, Thunderbird and Xulrunner as unaffected.

Testing has shown that the calls through Thebes only reach pixman with dimensions limited by display size.  Since exploitation requires a buffer of around at least 33MP, this can be considered safe.  Ditto for print to PDF/PS with any close to reasonable page size / DPI.