Bug 1945033 (CVE-2019-19004)

Summary:	CVE-2019-19004 autotrace: integer overflow in input-bmp.c
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	eng-i18n-bugs, gwync, jskarvad, lemenkov, mbenatto, pnemade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 22:52:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1945034, 1950140, 1950141
Bug Blocks:	1945039

Description Dhananjay Arunesh 2021-03-31 09:33:41 UTC

A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows
attackers to provide an unexpected input value to malloc via a malformed bitmap
image.

References:
https://github.com/autotrace/autotrace/commits/master
https://github.com/autotrace/autotrace/commits/master/src/input-bmp.c
https://github.com/autotrace/autotrace/pull/40

Comment 1 Dhananjay Arunesh 2021-03-31 09:34:19 UTC

Created autotrace tracking bugs for this issue:

Affects: fedora-all [bug 1945034]

Comment 3 Marco Benatto 2021-04-15 20:29:33 UTC

There's no upstream fix for that, although the pull request was created it was never committed.

Comment 4 Marco Benatto 2021-05-03 19:49:53 UTC

A crafted image with big width or bit counting can cause the bytes per row counting in input_bmp_header() to overflow. This value is further used in ReadImage() as parameter for the malloc() function through XMALLOC wrapper macro. As malloc's size parameter is handled as unsigned always, an eventual overflow on bytes per row variable will be handled as close to MAX_SIZE_T and probably failing the memory allocation, leading malloc() to return a NULL pointer. The XMALLOC macro assert's the malloc's returned pointer and finishes the process in such scenario, causing a DoS for the application consuming autotrace library.

Comment 9 errata-xmlrpc 2021-11-09 19:05:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4519 https://access.redhat.com/errata/RHSA-2021:4519

Comment 10 Product Security DevOps Team 2021-11-09 22:52:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19004