1542829 - (CVE-2019-7317) libpng use-after-free in png_image_free

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

Assigned CVE-2019-7317. Pretty trivial patch to backport.

https://github.com/glennrp/libpng/commit/9c0d5c77bf5bf2d7c1e11f388de40a70e0191550

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Comment 2

[Andrew McCreight [:mccr8]]

Here's the upstream CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-7317

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9056639 [details]
Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Unknown, but it's a publicly-disclosed bug so we should assume the worst.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Patch applies cleanly to all affected branches.
• How likely is this patch to cause regressions; how much testing does it need?: Patch is green on Try and passes upstream tests also.
  https://treeherder.mozilla.org/#/jobs?repo=try&revision=9485a09f1a16cce885371c6d99ca22aad02c21a0

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 9056639 [details]
Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Well, dang.

sec-approval+ on mozilla-central. We'll need it everywhere.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/autoland/rev/ffaff6fb1fe3

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ffaff6fb1fe3

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9056639 [details]
Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Beta/Release Uplift Approval Request

• Feature/Bug causing the regression: N/A
• User impact if declined: Publicly-disclosed libpng security vulnerability.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is just a cherry-pick of a trivial fix landed upstream.
• String changes made/needed: None

Comment 8

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9056639 [details]
Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Uplift approved for 67 beta, thanks.

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/e52e74683afc

Comment 10

[Cornel Ionce [:noni] [Hubs QA]]

Setting qe-verify - flag based on comment 7.

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9056639 [details]
Bug 1542829 - Backport an upstream libpng patch. r=aosmond

Sec high issue, public disclosure. OK for ESR 60.7.0.

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-esr60/rev/aca2f0b39735