<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png"
href="https://bugs.freedesktop.org/show_bug.cgi?id=98165">98165</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>DoS attack based on using SVG to generate invalid pointers from a _cairo_image_surface in write_png
</td>
</tr>
<tr>
<th>Product</th>
<td>cairo
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>critical
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>svg backend
</td>
</tr>
<tr>
<th>Assignee</th>
<td>emmanuel.pacaud@lapp.in2p3.fr
</td>
</tr>
<tr>
<th>Reporter</th>
<td>jbowler@acm.org
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>cairo-bugs@cairographics.org
</td>
</tr></table>
<p>
<div>
<pre>This is in cairo-1.14.6
This has already been reported on oss-security, although there is no analysis
there and as yet there is no CVE:
<a href="http://www.openwall.com/lists/oss-security/2016/10/06/1">http://www.openwall.com/lists/oss-security/2016/10/06/1</a>
The repro uses:
rsvg-convert -o crash.png crash.svg
The crash happens because write_png passes invalid (off by 4GByte) pointers to
libpng. The bug is in the declaration of _cairo_image_surface which obviously
won't work on a machine with a 64-bit address space and 32-bit (int) values.
The crash is 'just' a read from the invalid pointer inside libpng, however
there is at least one other case of the loop in read_png where the crash would
be a memory overwrite with data from the PNG; that version has been semi-fixed.
I'm not posting a detailed analysis because I'm not sure how many places the
bug is exposed and it is pretty clear given the fact that the loop in read_png
is different that you already know about one instance of this bug.
The libpng maintainer has a copy of my complete analysis and the original SVG,
I suggest not posting it at the moment because it took me about 4 minutes to
find the problem given the SVG.
I also suspect it isn't specific to SVG; I assume the read_png change came from
test jockeys hitting Cairo with various obvious PNG files, they tend to not
test SVG anywhere near as much.
The fix is to change 'stride' in the surface to (size_t), and preferably
width/height to (uint32_t) and depth to (unsigned). Doing that will reveal all
cases of the bug given a sufficiently high warning level.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>