Page MenuHomePhabricator

imlib2: XPM loader: uninitialized memory read
Closed, ResolvedPublic

Description

This is Debian bug https://bugs.debian.org/868151 reported by Jakub Wilk. A test case is attached to the Debian bug report.

loader_xpm.c contains the following code:

sscanf(line, "%i %i %i %i", &w, &h, &ncolors, &cpp);
if ((ncolors > 32766) || (ncolors < 1))
  ...

This doesn't check return value from sscanf(), so for some invalid XMP files
(such as the attached one), the ncolors variable will remain uninitialized.

Found using american fuzzy lop:
http://lcamtuf.coredump.cx/afl/

apoleon created this task.Mar 7 2018, 6:10 AM
apoleon triaged this task as Normal priority.
kwo closed this task as Resolved.Mar 7 2018, 10:50 AM

Should now be fixed in git.

kwo added a project: Restricted Project.Mar 10 2018, 12:22 PM