Bug 109760 – media-libs/libextractor integer overflow

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Glenn L. McGrath 2005-10-18 17:22:26 UTC]

Currently gentoo has media-libs/libextractor-0.5.4, upstream has released 0.5.6a.

One problem with 0.5.6a is that although the source is available via
http://gnunet.org/libextractor/ it hasnt been mirrored by GNU yet. The latest
version mirrored by GNU is 0.5.6.

Both 0.5.6 and 0.5.6a build fine for me on x86_64 (after i manually downloaded
0.5.6a)

Possible actions
 - Simple version bump from 0.5.4 to 0.5.6
 - Version bump to 0.5.6a and modify SRC_URI from GNU mirror to libextractor
home page, then modify SRC_URI back once GNU mirrors catch up.
 - Stay with 0.5.4 untill GNU mirrors catch up and do version bump to 0.5.6a.

I think it might be good enough to just go to 0.5.6 and hold of with 0.5.6a for
a while.


Reproducible: Always
Steps to Reproduce:
1.
2.
3.

[Comment 1 Karol Wojtaszek (RETIRED) 2005-10-29 07:43:09 UTC]

This relase fixes integer overflow. I don't know if it sourious bug, but
ChangeLog mentions:
Thu Sep 15 00:56:51 PDT 2005
        Fixed incorrectly handled integer overflow in png extractor.
Adding security to CC

[Comment 2 Sune Kloppenborg Jeppesen (RETIRED) 2005-10-30 00:42:54 UTC]

net-p2p please bump. 

[Comment 3 Marcin Kryczek (RETIRED) 2005-10-30 01:17:25 UTC]

(In reply to comment #2)
> net-p2p please bump. 

this is already bumped. i suppose sekretarz just wanted to let you know about this overflow

[Comment 4 Thierry Carrez (RETIRED) 2005-10-30 07:05:21 UTC]

x86 sparc: please test and mark 0.5.6a stable

[Comment 5 Mark Loeser (RETIRED) 2005-10-30 13:50:15 UTC]

Can't get marked stable until those dependencies are resolved.

  DEPEND.bad                     1
   media-libs/libextractor/libextractor-0.5.6a.ebuild:
x86(default-linux/x86/2005.0) ['>=x11-libs/gtk+-2.6.10']
  RDEPEND.bad                    1
   media-libs/libextractor/libextractor-0.5.6a.ebuild:
x86(default-linux/x86/2005.0) ['>=x11-libs/gtk+-2.6.10']

This is a problem for both sparc and x86.

[Comment 6 Gustavo Zacarias (RETIRED) 2005-11-02 09:09:12 UTC]

sparc stable.

[Comment 7 Mark Loeser (RETIRED) 2005-11-02 22:48:08 UTC]

x86 stable

[Comment 8 Thierry Carrez (RETIRED) 2005-11-03 01:23:39 UTC]

Ready for GLSA vote. 

I would vote yes right away if I was sure there was an exploitable vulnerability
fixed in this release. "Fixed incorrectly handled integer overflow in png
extractor" doesn't mean there was something exploitable here. I wonder if that
doesn't mean that the old fix was just a little dirty...

Someone will have to look deeper.

[Comment 9 Sune Kloppenborg Jeppesen (RETIRED) 2005-11-03 03:05:58 UTC]

Also waiting for further information before I can vote YES. 

[Comment 10 Thierry Carrez (RETIRED) 2005-11-03 08:08:03 UTC]

Hm. Really not sure about this one. I agree that pngextractor needed some
fixorz, but not sure they patch something exploitable. Apparently Debian agrees
with me since they pushed 0.5.6a without the security tag.

To make your own mind, I'll attach the 0.5.6a file and the 0.5.5 -> 0.5.6a
patchfile for pngextractor.c...

[Comment 11 Thierry Carrez (RETIRED) 2005-11-03 08:09:33 UTC]

Created attachment 72019 [details, diff]
pngextractor_0.5.5-0.5.6a.diff

The fix in question (diff between the 0.5.5 and the 0.5.6a version of
pngextractor.c)

[Comment 12 Thierry Carrez (RETIRED) 2005-11-03 08:10:19 UTC]

Created attachment 72020 [details]
pngextractor.c

pngextractor.c from 0.5.6a

[Comment 13 Thierry Carrez (RETIRED) 2005-11-03 08:19:46 UTC]

Created attachment 72023 [details, diff]
pngextractor_0.5.5-0.5.6a.patch

The unified one, so that taviso can read it :P

[Comment 14 Tavis Ormandy (RETIRED) 2005-11-03 08:26:47 UTC]

There does not appear to be any security impact here, marking CLOSED.