Page MenuHomePhabricator

imlib2: XPM loader: uninitialized memory read
Closed, ResolvedPublic


This is Debian bug reported by Jakub Wilk. A test case is attached to the Debian bug report.

loader_xpm.c contains the following code:

sscanf(line, "%i %i %i %i", &w, &h, &ncolors, &cpp);
if ((ncolors > 32766) || (ncolors < 1))

This doesn't check return value from sscanf(), so for some invalid XMP files
(such as the attached one), the ncolors variable will remain uninitialized.

Found using american fuzzy lop:

apoleon created this task.Mar 7 2018, 6:10 AM
apoleon triaged this task as Normal priority.
kwo closed this task as Resolved.Mar 7 2018, 10:50 AM

Should now be fixed in git.

kwo added a project: Restricted Project.Mar 10 2018, 12:22 PM