Bug 1531397 – CVE-2017-1000422 gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can lead to memory corruption and potential code execution

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1531397 - (CVE-2017-1000422) CVE-2017-1000422 gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can lead to memory corruption and potential code execution

Summary:	CVE-2017-1000422 gdk-pixbuf: Integer overflow in io-gif.c:gif_get_lzw() can l...

Status:	CLOSED NOTABUG

Aliases:	CVE-2017-1000422

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170807,repor...
Keywords:	Security

Depends On:
Blocks:	1531399
	Show dependency tree / graph

Reported:	2018-01-05 00:31 EST by Sam Fowler
Modified:	2018-01-21 23:45 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-01-21 23:45:03 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Sam Fowler 2018-01-05 00:31:58 EST

Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflows in the io-gif.c:gif_get_lzw() function resulting in memory corruption and potential code execution.


References:
https://bugzilla.gnome.org/show_bug.cgi?id=785973
https://git.gnome.org/browse/gdk-pixbuf/commit/?id=0012e06
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422
https://bugzilla.novell.com/show_bug.cgi?id=1074462

Comment 1 Huzaifa S. Sidhpurwala 2018-01-21 23:45:03 EST

Analysis:

When rendering very large GIF files, gdk-pixbuf2 would previously fail after attempting to allocate memory because of a possible integer overflow, since frame_len * frame_height would be result in an overflow.

https://git.gnome.org/browse/gdk-pixbuf/commit/?id=0012e06 (patch fixing this CVE) detects the overflow before attempting to allocate memory.

Therefore essentially the flaw is already mitigated in the existing code. It is preferable to be able to detect an overflow before attempting memory, but not doing so should not be a flaw in itself.

Note You need to log in before you can comment on or make changes to this bug.