An integer underflow was found in gdk-pixbuf that allows an attacker to make different calls to gdk_pixbuf_loader_write with a huge (2^32-1) count (size of buffer) that can be bigger than the actual size of given buffer. It is possible to give the loader any data we want so we can call any desired loader that it's data is recognized. This may lead to various behaviors - multiple out-of-buffer reads, infinite loops, or allocation attempt with the size. References: http://seclists.org/oss-sec/2017/q1/466 http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html Upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=779016
Created gdk-pixbuf2 tracking bugs for this issue: Affects: fedora-all [bug 1427225] Created mingw-gdk-pixbuf tracking bugs for this issue: Affects: fedora-all [bug 1427226]
Created mingw-gdk-pixbuf tracking bugs for this issue: Affects: epel-7 [bug 1427229]