An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. References: https://codereview.qt-project.org/c/qt/qtbase/+/308436 https://codereview.qt-project.org/c/qt/qtbase/+/308495 https://codereview.qt-project.org/c/qt/qtbase/+/308496
Created qt tracking bugs for this issue: Affects: fedora-all [bug 1868534]
Yes, Qt 4 appears to be vulnerable, we need to backport the fix. (Qt 3, on the other hand, does not contain the affected code (the XBM loader), so it cannot be vulnerable.)
Flaw summary: In src/gui/image/qxbmhandler.cpp of Qt, there is a buffer overread in the read_xbm_body() function, which reads an X Bitmap Image body from an IO device. The function reads 300 bytes at a time from the input device into `buf` and then uses the pointer `p` to locate and parse hex data from within the buffer. Although the code checks for whether `p` is NULL, it does not check that `p` is inside of the bounds of `buf`. Since `p` is incremented in the loop, and the exit condition is based off of the height value of the XBM, it is possible for a buffer overread to occur due to a crafted height value where `p` is passed to hex2byte() or strstr(). The patch ensures on every iteration of the loop that `p` does not go out of bounds of `buf` and a check for whether the third and fourth chars are hex digits (i.e. 0x3A and not 0x*%) was also added. There is a hardcoded buflen of 300, and the patch's commit message notes that this leaves parsing of lines longer than this unreliable.
FEDORA-2020-8dd86f1b3f has been pushed to the Fedora 31 stable repository. If problem still persists, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:5021 https://access.redhat.com/errata/RHSA-2020:5021
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-17507
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1756 https://access.redhat.com/errata/RHSA-2021:1756