In create_bits() both height and stride are ints, so the result is also an int, which will overflow if height or stride are big enough and size_t is bigger than int. External references: http://lists.freedesktop.org/archives/pixman/2014-April/003244.html CVE assignment: http://seclists.org/oss-sec/2016/q1/425
Updated affects list for RHEL components. Not affected because they already have the patch: rhel-6/pixman rhel-7/pixman rhel-7/qemu-guest-agent Not affected because the guard is _pixman_multiply_overflows_int which matches the type of each operand and thus the result of the multiplication: rhel-5/pixman rhel-5/qpixman rhel-7/qemu-qvm Removed from whiteboard because these packages don't appear to exist in current manifests: epel-7/mingw-pixman rhev-m-3/mingw-virt-viewer Ping Kurt - not sure if I'm treating rhev-m correctly or looking in the right places to audit.
What info is needed?
Based on assertions from Mozilla that they believe their products only use the affected code in a safe context (with bounded width & height), and testing with firefox and thunderbird that has failed to disprove this assertion, I am marking Firefox, Thunderbird and Xulrunner as unaffected. Testing has shown that the calls through Thebes only reach pixman with dimensions limited by display size. Since exploitation requires a buffer of around at least 33MP, this can be considered safe. Ditto for print to PDF/PS with any close to reasonable page size / DPI.