242915 - PNG out-of-bounds read during error message processing

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Glenn Randers-Pehrson]

A bug in pngerror.c has been discovered recently and reported to bugtraq and
various distro mailing lists.  The PNG Group has developed and released a patch
for the bug.  It is highly unlikely that the bug could actually be exploited.

Comment 1

[Glenn Randers-Pehrson]

Attachment: patch for PNG read-out-of-bounds bug in pngerror

Here is a copy of the PNG group's patch.  It uses strncpy() while some distro
vendors are providing a patch that uses strlen() followed by memcpy().	The PNG
group believes that the strncpy solution is more robust.

Comment 2

[Glenn Randers-Pehrson]

Comment on attachment 147883 [details] [diff] [review]
patch for PNG read-out-of-bounds bug in pngerror

tor: r?

Comment 3

[tor]

Checked in on trunk.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 147883 [details] [diff] [review]
patch for PNG read-out-of-bounds bug in pngerror

a=dveditz for 1.7

Comment 5

[Daniel Veditz [:dveditz]]

Sorry for bug spam, setting and clearing security flag so it'll show up on the
right queries

Comment 6

[Daniel Veditz [:dveditz]]

Checked in on 1.7 branch

Comment 7

[tor]

In on trunk/branch - closing.

Comment 8

[Daniel Veditz [:dveditz]]

References from CAN-2004-0421
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0421):

DEBIAN:DSA-498
http://www.debian.org/security/2004/dsa-498

MANDRAKE:MDKSA-2004:040
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:040

REDHAT:RHSA-2004:180
http://www.redhat.com/support/errata/RHSA-2004-180.html

REDHAT:RHSA-2004:181
http://www.redhat.com/support/errata/RHSA-2004-181.html

BUGTRAQ:20040429 [OpenPKG-SA-2004.017] OpenPKG Security Advisory (png)
http://marc.theaimsgroup.com/?l=bugtraq&m=108334922320309&w=2

TRUSTIX:2004-0025
http://marc.theaimsgroup.com/?l=bugtraq&m=108335030208523&w=2

FEDORA:FEDORA-2004-105
http://marc.theaimsgroup.com/?l=fedora-announce-list&m=108451350029261&w=2

FEDORA:FEDORA-2004-106
http://marc.theaimsgroup.com/?l=fedora-announce-list&m=108451353608968&w=2

libpng-png-dos(16022)
http://xforce.iss.net/xforce/xfdb/16022

Comment 9

[Daniel Veditz [:dveditz]]

Adding Jon Granrose to CC list to help round up QA resources for verification

Comment 10

[Jon Granrose]

adding tracy to verify on 1.7

Comment 11

[Tracy Walker [:tracy]]

Glenn, can you provide a test case or verify this is fixed in 1.7?

Comment 12

[Glenn Randers-Pehrson]

There is no exploit, to my knowledge, nor any test case.  I have just examined
the source code of a fresh checkout of Moz-1.7 and can verify that the bug has
been fixed.  However, the trunk version of MOZCHANGES wasn't checked in to Moz-1.7.

Comment 13

[Tracy Walker [:tracy]]

verified per reporters comments

Comment 14

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 147883 [details] [diff] [review]
patch for PNG read-out-of-bounds bug in pngerror

a=blizzard