Bugzilla Bug 201887

Short version: The _LoadBMP function in imlib 1.9.15 and earlier allows
context-dependent attackers to cause a denial of service (infinite loop) via a
BMP image with a Bits Per Page (BPP) value of 0.

A bit longer:
=====================================================
The information has been provided by beSTORM.
The original article can be found at:
http://www.beyondsecurity.com/bestorm_overview.html

Vulnerable Systems:
 * imlib version 1.9.15 and prior

The _LoadBMP function reads from the BMP file the value of BPP (Bits Per Page)
and uses that value to know how many bits need to be read at each step of its
main file processing loop. The value of 0x0000 (zero) which is invalid, is not
properly detected as the line responsible:
if (bpp != 1 && bpp != 4 && bpp != 8 && bpp && 16 && bpp != 24 && bpp != 32)
{
fprintf(stderr, "IMLIB ERROR: unknown bitdepth in file\n");
return NULL;
}


Incorrectly references && bpp && where it shouldn't have probably referenced it
at all to prevent the value of 0x0000 from passing.

Since the bpp value of 0x0000 is used, the loop:
  for (line = (*h - 1); line >= 0; line--)
    {
      linepos = 0;
      for (column = 0; column < *w;)
    {

Will never advanced as no case inside the loop matches the bpp value of 0x0000.

Workaround:
Remove the && bpp && from the if statement found at line 648.

Vendor status:
We have tried to contact the security person responsible for the package in
Debian, but they haven't addressed it. We have sent an email to the author of
imlib on 2007-07-03 but the product appears to be no longer maintained by the
author as the last release was released on 2004-09-24.
=====================================================

Although I did not manage to get exploit seems that it's possibile to create
one. Thus I'm setting status to major.

Updated imlib-1.9.15-r2 which includes the fix is in portage. Please, review
and proceed as required.

Assigning on security as this is security issue.

Thanks Peter. Arches, please test and mark stable media-libs/imlib-1.9.15-r2.
Target "alpha amd64 arm hppa ia64 mips ppc ppc64 sh sparc x86 ~x86-fbsd"

Amd64, this also affects emul-linux-x86-gtklibs. Please update.

x86 stable

Stable for sparc.

Stable for HPPA.

alpha/ia64 stable

Ebuild stable on amd64, emul stuff yet to come.

Bumped app-emulation/emul-linux-x86-gtklibs - amd64 guys, please test and
stable. (If the tarball hasn't yet hit the mirrors, fetch it from here:
http://dev.gentoo.org/~welp/emul-linux-x86-gtklibs-20071214.tar.bz2)

ppc64 stable

ppc stable

emul-linux-x86-gtklibs-20071214 (which contains the fix) is stable on amd64,
thanks to gentoofan23 for testing.

Ready for glsa vote.

Since this library and function is very unlikely to be called from remote, I
vote NO here.

no too, and closing.

Does not affect current (2008.0) release. Removing release.