head 1.6; access; symbols OPENPKG_E1_MP_HEAD:1.5 OPENPKG_E1_MP:1.5 OPENPKG_E1_MP_2_STABLE:1.5 OPENPKG_E1_FP:1.5 OPENPKG_2_STABLE_MP:1.5 OPENPKG_2_STABLE_20061018:1.5 OPENPKG_2_STABLE_20060622:1.5 OPENPKG_2_STABLE:1.5.0.10 OPENPKG_2_STABLE_BP:1.5 OPENPKG_2_5_RELEASE:1.5 OPENPKG_2_5_SOLID:1.5.0.8 OPENPKG_2_5_SOLID_BP:1.5 OPENPKG_2_4_RELEASE:1.5 OPENPKG_2_4_SOLID:1.5.0.6 OPENPKG_2_4_SOLID_BP:1.5 OPENPKG_CW_FP:1.5 OPENPKG_2_3_RELEASE:1.5 OPENPKG_2_3_SOLID:1.5.0.4 OPENPKG_2_3_SOLID_BP:1.5 OPENPKG_2_2_RELEASE:1.5 OPENPKG_2_2_SOLID:1.5.0.2 OPENPKG_2_2_SOLID_BP:1.5 OPENPKG_2_1_RELEASE:1.4 OPENPKG_2_1_SOLID:1.4.0.2 OPENPKG_2_1_SOLID_BP:1.4 OPENPKG_1_3_SOLID:1.3.0.2 OPENPKG_2_0_RELEASE:1.2 OPENPKG_2_0_SOLID:1.2.0.2 OPENPKG_2_0_SOLID_BP:1.2; locks; strict; comment @# @; 1.6 date 2007.12.20.09.18.09; author rse; state Exp; branches; next 1.5; commitid fQaTlg81cjpVl9Ks; 1.5 date 2004.08.04.14.01.54; author thl; state Exp; branches; next 1.4; 1.4 date 2004.07.01.14.10.12; author tho; state Exp; branches 1.4.2.1; next 1.3; 1.3 date 2004.04.29.15.06.57; author thl; state Exp; branches 1.3.2.1; next 1.2; 1.2 date 2003.10.24.08.10.46; author rse; state dead; branches 1.2.2.1; next 1.1; 1.1 date 2003.10.09.11.37.16; author rse; state Exp; branches; next ; 1.4.2.1 date 2004.08.04.14.02.59; author thl; state Exp; branches; next ; 1.3.2.1 date 2004.04.29.19.56.26; author thl; state Exp; branches; next 1.3.2.2; 1.3.2.2 date 2004.07.06.13.41.40; author tho; state Exp; branches; next ; 1.2.2.1 date 2004.04.29.16.17.51; author thl; state Exp; branches; next 1.2.2.2; 1.2.2.2 date 2004.07.06.13.33.24; author tho; state Exp; branches; next 1.2.2.3; 1.2.2.3 date 2004.08.04.14.05.39; author thl; state Exp; branches; next ; desc @@ 1.6 log @modifying package: perl-tk-5.10.0 20071219 -> 20071220 @ text @Index: Tk-804.028/PNG/libpng/pngconf.h --- Tk-804.028/PNG/libpng/pngconf.h.orig 2007-05-05 20:38:41 +0200 +++ Tk-804.028/PNG/libpng/pngconf.h 2007-12-20 09:49:47 +0100 @@@@ -310,13 +310,6 @@@@ # define PNG_SAVE_BSD_SOURCE # undef _BSD_SOURCE # endif -# ifdef _SETJMP_H - /* If you encounter a compiler error here, see the explanation - * near the end of INSTALL. - */ - __png.h__ already includes setjmp.h; - __dont__ include it again.; -# endif # endif /* __linux__ */ /* include setjmp.h for error handling */ Index: Tk-PNG-2.005/libpng/pngconf.h --- Tk-PNG-2.005/libpng/pngconf.h.orig 2000-04-21 20:57:31 +0200 +++ Tk-PNG-2.005/libpng/pngconf.h 2007-12-20 09:48:54 +0100 @@@@ -119,10 +119,6 @@@@ #define _PNG_SAVE_BSD_SOURCE #undef _BSD_SOURCE #endif -#ifdef _SETJMP_H -__png.h__ already includes setjmp.h -__dont__ include it again -#endif #endif /* __linux__ */ /* include setjmp.h for error handling */ @ 1.5 log @SA-2004.035-png; CAN-2004-0597, CAN-2004-0598, CAN-2004-0599 @ text @d1 17 d19 2 a20 2 --- Tk-PNG-2.005/libpng/pngconf.h.orig 2004-07-01 13:18:23 +0200 +++ Tk-PNG-2.005/libpng/pngconf.h 2004-07-01 13:30:50 +0200 a31 816 Index: Tk-PNG-2.005/libpng/pngerror.c --- Tk-PNG-2.005/libpng/pngerror.c.orig 2004-07-01 13:18:23 +0200 +++ Tk-PNG-2.005/libpng/pngerror.c 2004-07-01 13:34:07 +0200 @@@@ -82,10 +82,13 @@@@ if (message == NULL) buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } Index: Tk-PNG-2.005/libpng/pngrtran.c --- Tk-PNG-2.005/libpng/pngrtran.c.orig 2000-04-21 20:57:35 +0200 +++ Tk-PNG-2.005/libpng/pngrtran.c 2004-07-01 13:18:23 +0200 @@@@ -1783,8 +1783,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1801,8 +1801,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@@@ -1859,8 +1859,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1881,8 +1881,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Index: Tk-804.027/PNG/libpng/pngconf.h --- Tk-804.027/PNG/libpng/pngconf.h.orig 2003-11-29 12:39:30 +0100 +++ Tk-804.027/PNG/libpng/pngconf.h 2004-07-01 13:36:23 +0200 @@@@ -251,10 +251,6 @@@@ # define PNG_SAVE_BSD_SOURCE # undef _BSD_SOURCE # endif -# ifdef _SETJMP_H - __png.h__ already includes setjmp.h; - __dont__ include it again.; -# endif # endif /* __linux__ */ /* include setjmp.h for error handling */ Index: Tk-804.027/PNG/libpng/pngerror.c --- Tk-804.027/PNG/libpng/pngerror.c.orig 2003-11-29 12:39:30 +0100 +++ Tk-804.027/PNG/libpng/pngerror.c 2004-07-01 13:36:23 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } Index: Tk-804.027/PNG/libpng/pngrtran.c --- Tk-804.027/PNG/libpng/pngrtran.c.orig 2003-11-29 12:39:31 +0100 +++ Tk-804.027/PNG/libpng/pngrtran.c 2004-07-01 13:36:23 +0200 @@@@ -1889,8 +1889,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1907,8 +1907,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03a-trns-chunk-overflow.txt Use to patch libpng-0.89 through 1.0.5. Does not work with libpng-0.88 and earlier. This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch03a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:41:02 2004 @@@@ -754,7 +754,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > 256) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04a-get-uint-31.txt Use to patch libpng-1.0.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.0.5/png.h libpng-1.0.5patch04a/png.h --- Tk-PNG-2.005/libpng/png.h.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/png.h Fri Jul 23 22:02:58 2004 @@@@ -510,7 +510,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -1839,6 +1843,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - NOT DLL EXPORTED). diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch04a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:02:59 2004 @@@@ -18,6 +18,14 @@@@ #include "pngasmrd.h" #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-PNG-2.005/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-PNG-2.005/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06a-pngread-chunklength.txt Use to patch libpng-1.0.0 through 1.0.12, 1.2.0, and 1.2.1. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.1/pngread.c libpng-1.2.1patch06a/pngread.c --- Tk-PNG-2.005/libpng/pngread.c.orig Wed Dec 12 17:37:21 2001 +++ Tk-PNG-2.005/libpng/pngread.c Fri Jul 23 20:15:23 2004 @@@@ -365,7 +365,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -654,7 +654,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -927,7 +927,7 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. This is a OpenPKG backport to 1.0.5 diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -403,7 +407,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -475,7 +479,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -487,7 +491,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -539,7 +543,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -676,7 +680,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-PNG-2.005/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-PNG-2.005/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-PNG-2.005/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_debug(1, "in png_handle_hIST\n"); @@@@ -946,14 +950,14 @@@@ return; } - if (length != (png_uint_32)(2 * png_ptr->num_palette)) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); return; } - num = (int)length / 2 ; png_ptr->hist = (png_uint_16p)png_malloc(png_ptr, (png_uint_32)(num * sizeof (png_uint_16))); png_ptr->flags |= PNG_FLAG_FREE_HIST; @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-overflow.txt Use to patch libpng-1.0.9 through 1.2.5 This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch03/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 18:54:36 2004 @@@@ -1241,7 +1241,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > (png_uint_32)png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04-get-uint-31.txt Use to patch libpng-1.0.6 through 1.2.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h --- Tk-804.027/PNG/libpng/png.h.orig Thu Oct 3 06:32:26 2002 +++ Tk-804.027/PNG/libpng/png.h Fri Jul 23 18:56:27 2004 @@@@ -833,7 +833,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -2655,6 +2659,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch04/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 18:56:27 2004 @@@@ -38,6 +38,14 @@@@ # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-804.027/PNG/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-804.027/PNG/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06-pngread-chunklength.txt Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c --- Tk-804.027/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.027/PNG/libpng/pngread.c Fri Jul 23 18:59:57 2004 @@@@ -384,7 +384,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -392,9 +392,6 @@@@ png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@@@ -673,10 +670,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -946,15 +940,12 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch07/pngread.c --- Tk-804.027/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.027/PNG/libpng/pngread.c Fri Jul 23 19:01:39 2004 @@@@ -1299,6 +1299,9 @@@@ */ png_read_info(png_ptr, info_ptr); + if (info_ptr->height > PNG_UINT_32_MAX/sizeof(png_bytep)) + png_error(png_ptr,"Image is too high to process with png_read_png()"); + /* -------------- image transformations start here ------------------- */ #if defined(PNG_READ_16_TO_8_SUPPORTED) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch08-splt-buffer-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer) diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch08/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:02:48 2004 @@@@ -1154,8 +1154,18 @@@@ } new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( + if (new_palette.nentries > PNG_SIZE_MAX / sizeof(png_sPLT_entry)) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch09-null-iccp-profile.txt Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8. Libpng-1.0.5 and earlier didn't implement iCCP chunk reading. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch09/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:04:28 2004 @@@@ -977,8 +977,7 @@@@ png_bytep pC; png_charp profile; png_uint_32 skip = 0; - png_uint_32 profile_size = 0; - png_uint_32 profile_length = 0; + png_uint_32 profile_size, profile_length; png_size_t slength, prefix_length, data_length; png_debug(1, "in png_handle_iCCP\n"); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -579,7 +579,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -660,7 +660,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -729,7 +729,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -891,7 +891,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); @@@@ -995,7 +995,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place iCCP chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) { png_warning(png_ptr, "Duplicate iCCP chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-804.027/PNG/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-804.027/PNG/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-804.027/PNG/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@@@ -1426,8 +1431,8 @@@@ return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @ 1.4 log @added Security Fix (CAN-2002-1363) for png @ text @d161 670 @ 1.4.2.1 log @SA-2004.035-png; CAN-2004-0597, CAN-2004-0598, CAN-2004-0599 @ text @a160 670 http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03a-trns-chunk-overflow.txt Use to patch libpng-0.89 through 1.0.5. Does not work with libpng-0.88 and earlier. This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch03a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:41:02 2004 @@@@ -754,7 +754,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > 256) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04a-get-uint-31.txt Use to patch libpng-1.0.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.0.5/png.h libpng-1.0.5patch04a/png.h --- Tk-PNG-2.005/libpng/png.h.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/png.h Fri Jul 23 22:02:58 2004 @@@@ -510,7 +510,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -1839,6 +1843,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - NOT DLL EXPORTED). diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch04a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:02:59 2004 @@@@ -18,6 +18,14 @@@@ #include "pngasmrd.h" #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-PNG-2.005/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-PNG-2.005/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06a-pngread-chunklength.txt Use to patch libpng-1.0.0 through 1.0.12, 1.2.0, and 1.2.1. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.1/pngread.c libpng-1.2.1patch06a/pngread.c --- Tk-PNG-2.005/libpng/pngread.c.orig Wed Dec 12 17:37:21 2001 +++ Tk-PNG-2.005/libpng/pngread.c Fri Jul 23 20:15:23 2004 @@@@ -365,7 +365,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -654,7 +654,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -927,7 +927,7 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. This is a OpenPKG backport to 1.0.5 diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -403,7 +407,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -475,7 +479,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -487,7 +491,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -539,7 +543,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -676,7 +680,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-PNG-2.005/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-PNG-2.005/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-PNG-2.005/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_debug(1, "in png_handle_hIST\n"); @@@@ -946,14 +950,14 @@@@ return; } - if (length != (png_uint_32)(2 * png_ptr->num_palette)) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); return; } - num = (int)length / 2 ; png_ptr->hist = (png_uint_16p)png_malloc(png_ptr, (png_uint_32)(num * sizeof (png_uint_16))); png_ptr->flags |= PNG_FLAG_FREE_HIST; @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-overflow.txt Use to patch libpng-1.0.9 through 1.2.5 This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch03/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 18:54:36 2004 @@@@ -1241,7 +1241,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > (png_uint_32)png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04-get-uint-31.txt Use to patch libpng-1.0.6 through 1.2.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h --- Tk-804.027/PNG/libpng/png.h.orig Thu Oct 3 06:32:26 2002 +++ Tk-804.027/PNG/libpng/png.h Fri Jul 23 18:56:27 2004 @@@@ -833,7 +833,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -2655,6 +2659,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch04/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 18:56:27 2004 @@@@ -38,6 +38,14 @@@@ # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-804.027/PNG/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-804.027/PNG/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06-pngread-chunklength.txt Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c --- Tk-804.027/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.027/PNG/libpng/pngread.c Fri Jul 23 18:59:57 2004 @@@@ -384,7 +384,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -392,9 +392,6 @@@@ png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@@@ -673,10 +670,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -946,15 +940,12 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch07/pngread.c --- Tk-804.027/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.027/PNG/libpng/pngread.c Fri Jul 23 19:01:39 2004 @@@@ -1299,6 +1299,9 @@@@ */ png_read_info(png_ptr, info_ptr); + if (info_ptr->height > PNG_UINT_32_MAX/sizeof(png_bytep)) + png_error(png_ptr,"Image is too high to process with png_read_png()"); + /* -------------- image transformations start here ------------------- */ #if defined(PNG_READ_16_TO_8_SUPPORTED) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch08-splt-buffer-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer) diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch08/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:02:48 2004 @@@@ -1154,8 +1154,18 @@@@ } new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( + if (new_palette.nentries > PNG_SIZE_MAX / sizeof(png_sPLT_entry)) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch09-null-iccp-profile.txt Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8. Libpng-1.0.5 and earlier didn't implement iCCP chunk reading. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch09/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:04:28 2004 @@@@ -977,8 +977,7 @@@@ png_bytep pC; png_charp profile; png_uint_32 skip = 0; - png_uint_32 profile_size = 0; - png_uint_32 profile_length = 0; + png_uint_32 profile_size, profile_length; png_size_t slength, prefix_length, data_length; png_debug(1, "in png_handle_iCCP\n"); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.027/PNG/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -579,7 +579,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -660,7 +660,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -729,7 +729,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -891,7 +891,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); @@@@ -995,7 +995,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place iCCP chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) { png_warning(png_ptr, "Duplicate iCCP chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-804.027/PNG/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-804.027/PNG/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-804.027/PNG/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-804.027/PNG/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@@@ -1426,8 +1431,8 @@@@ return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @ 1.3 log @SA-2004.017-png @ text @d1 59 a59 3 --- Tk-804.027/PNG/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ Tk-804.027/PNG/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ d70 1 a70 1 @@@@ -1987,8 +1987,8 @@@@ d81 17 a97 7 Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- Tk-804.027/PNG/libpng/pngerror.c.orig 2002-10-03 13:32:27.000000000 +0200 +++ Tk-804.027/PNG/libpng/pngerror.c 2004-04-28 13:24:22.000000000 +0200 d114 25 a138 2 --- Tk-PNG-2.005/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ Tk-PNG-2.005/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 a160 26 Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- Tk-PNG-2.005/libpng/pngerror.c.orig 2004-04-29 15:33:33.000000000 +0200 +++ Tk-PNG-2.005/libpng/pngerror.c 2004-04-29 15:35:46.000000000 +0200 @@@@ -81,11 +81,15 @@@@ if (message == NULL) buffer[iout] = 0; - else { + else + { + png_size_t len; + if ((len = png_strlen(message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, message, len); + buffer[iout+len] = 0; } } @ 1.3.2.1 log @SA-2004.017-png @ text @d1 47 @ 1.3.2.2 log @SA-2004.030; CAN-2002-1363 @ text @d1 3 a3 45 Index: Tk-PNG-2.005/libpng/pngerror.c --- Tk-PNG-2.005/libpng/pngerror.c.orig 2000-04-21 20:57:31 +0200 +++ Tk-PNG-2.005/libpng/pngerror.c 2004-07-05 17:08:21 +0200 @@@@ -82,10 +82,13 @@@@ if (message == NULL) buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, message, len); + buffer[iout+len] = 0; } } Index: Tk-PNG-2.005/libpng/pngrtran.c --- Tk-PNG-2.005/libpng/pngrtran.c.orig 2000-04-21 20:57:35 +0200 +++ Tk-PNG-2.005/libpng/pngrtran.c 2004-07-05 17:06:04 +0200 @@@@ -1783,8 +1783,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1801,8 +1801,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@@@ -1859,8 +1859,8 @@@@ d14 1 a14 1 @@@@ -1881,8 +1881,8 @@@@ d25 26 @ 1.2 log @upgrading package: perl-tk 20031009 -> 20031024 @ text @d1 97 a97 22 Index: Tk800.024/Tk/MMutil.pm --- Tk800.024/Tk/MMutil.pm.orig 2002-03-05 15:27:40.000000000 +0100 +++ Tk800.024/Tk/MMutil.pm 2003-10-09 11:45:43.000000000 +0200 @@@@ -330,18 +330,6 @@@@ my $self = shift; # Maybe always call UNIX version - we HTMLize them later local $_ = $self->MM::manifypods; - if ($] >= 5.00565) - { - s/(POD2MAN_EXE.*pod2man)/$1 --center "perl\/Tk Documentation" --release "Tk\$(VERSION)"/; - } - elsif ($] >= 5.003) - { - s/(POD2MAN_EXE.*pod2man)/$1 -center "perl\/Tk Documentation" -release "Tk\$(VERSION)"/; - } - else - { - s/(POD2MAN_EXE.*pod2man)/$1 -center \\"perl\/Tk Documentation\\" -release \\"Tk\$(VERSION)\\"/; - } s/\bpod::/Tk::/mg; s/\bpTk:://mg; $_; @ 1.2.2.1 log @SA-2004.017-png @ text @d1 22 a22 97 --- Tk-804.025_beta14/PNG/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- Tk-804.025_beta14/PNG/libpng/pngerror.c.orig 2002-10-03 13:32:27.000000000 +0200 +++ Tk-804.025_beta14/PNG/libpng/pngerror.c 2004-04-28 13:24:22.000000000 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } --- Tk-PNG-2.005/libpng/pngrtran.c.orig Wed Oct 2 20:20:24 2002 +++ Tk-PNG-2.005/libpng/pngrtran.c Wed Jan 15 11:30:23 2003 @@@@ -1965,8 +1965,8 @@@@ /* This changes the data from RRGGBB to RRGGBBXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1987,8 +1987,8 @@@@ /* This changes the data from RRGGBB to XXRRGGBB */ else { - png_bytep sp = row + (png_size_t)row_width * 3; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 6; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); Steve G Libpng accesses memory that is out of bounds when creating an error message Index: pngerror.c --- Tk-PNG-2.005/libpng/pngerror.c.orig 2004-04-29 15:33:33.000000000 +0200 +++ Tk-PNG-2.005/libpng/pngerror.c 2004-04-29 15:35:46.000000000 +0200 @@@@ -81,11 +81,15 @@@@ if (message == NULL) buffer[iout] = 0; - else { + else + { + png_size_t len; + if ((len = png_strlen(message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, message, len); + buffer[iout+len] = 0; } } @ 1.2.2.2 log @SA-2004.030; CAN-2002-1363 @ text @d1 2 a2 44 Index: Tk-804.025_beta14/PNG/libpng/pngerror.c --- Tk-804.025_beta14/PNG/libpng/pngerror.c.orig 2003-11-29 12:39:30 +0100 +++ Tk-804.025_beta14/PNG/libpng/pngerror.c 2004-07-05 14:34:15 +0200 @@@@ -135,10 +135,13 @@@@ buffer[iout] = 0; else { + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; buffer[iout++] = ':'; buffer[iout++] = ' '; - png_memcpy(buffer+iout, error_message, 64); - buffer[iout+63] = 0; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; } } Index: Tk-804.025_beta14/PNG/libpng/pngrtran.c --- Tk-804.025_beta14/PNG/libpng/pngrtran.c.orig 2003-11-29 12:39:31 +0100 +++ Tk-804.025_beta14/PNG/libpng/pngrtran.c 2004-07-05 14:34:15 +0200 @@@@ -1889,8 +1889,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1907,8 +1907,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); d25 8 a32 5 Index: Tk-PNG-2.005/libpng/pngerror.c --- Tk-PNG-2.005/libpng/pngerror.c.orig 2000-04-21 20:57:31 +0200 +++ Tk-PNG-2.005/libpng/pngerror.c 2004-07-05 14:42:01 +0200 @@@@ -82,10 +82,13 @@@@ if (message == NULL) d34 8 a41 4 else { - buffer[iout++] = ':'; - buffer[iout++] = ' '; - png_memcpy(buffer+iout, message, 64); d43 2 a44 7 + png_size_t len; + if ((len = png_strlen(error_message)) > 63) + len = 63; + buffer[iout++] = ':'; + buffer[iout++] = ' '; + png_memcpy(buffer+iout, error_message, len); + buffer[iout+len] = 0; d48 3 a50 26 Index: Tk-PNG-2.005/libpng/pngrtran.c --- Tk-PNG-2.005/libpng/pngrtran.c.orig 2000-04-21 20:57:35 +0200 +++ Tk-PNG-2.005/libpng/pngrtran.c 2004-07-05 14:35:43 +0200 @@@@ -1783,8 +1783,8 @@@@ /* This changes the data from GG to GGXX */ if (flags & PNG_FLAG_FILLER_AFTER) { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 1; i < row_width; i++) { *(--dp) = hi_filler; @@@@ -1801,8 +1801,8 @@@@ /* This changes the data from GG to XXGG */ else { - png_bytep sp = row + (png_size_t)row_width; - png_bytep dp = sp + (png_size_t)row_width; + png_bytep sp = row + (png_size_t)row_width * 2; + png_bytep dp = sp + (png_size_t)row_width * 2; for (i = 0; i < row_width; i++) { *(--dp) = *(--sp); @@@@ -1859,8 +1859,8 @@@@ d61 1 a61 1 @@@@ -1881,8 +1881,8 @@@@ d72 26 @ 1.2.2.3 log @SA-2004.035-png; CAN-2004-0597, CAN-2004-0598, CAN-2004-0599 @ text @a134 670 http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03a-trns-chunk-overflow.txt Use to patch libpng-0.89 through 1.0.5. Does not work with libpng-0.88 and earlier. This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch03a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:41:02 2004 @@@@ -754,7 +754,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > 256) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04a-get-uint-31.txt Use to patch libpng-1.0.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.0.5/png.h libpng-1.0.5patch04a/png.h --- Tk-PNG-2.005/libpng/png.h.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/png.h Fri Jul 23 22:02:58 2004 @@@@ -510,7 +510,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -1839,6 +1843,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - NOT DLL EXPORTED). diff -r -U 3 libpng-1.0.5/pngrutil.c libpng-1.0.5patch04a/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 14 07:43:08 1999 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 22:02:59 2004 @@@@ -18,6 +18,14 @@@@ #include "pngasmrd.h" #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-PNG-2.005/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-PNG-2.005/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06a-pngread-chunklength.txt Use to patch libpng-1.0.0 through 1.0.12, 1.2.0, and 1.2.1. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.1/pngread.c libpng-1.2.1patch06a/pngread.c --- Tk-PNG-2.005/libpng/pngread.c.orig Wed Dec 12 17:37:21 2001 +++ Tk-PNG-2.005/libpng/pngread.c Fri Jul 23 20:15:23 2004 @@@@ -365,7 +365,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -654,7 +654,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -927,7 +927,7 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. This is a OpenPKG backport to 1.0.5 diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-PNG-2.005/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -403,7 +407,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_gAMA #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -475,7 +479,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sBIT) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -487,7 +491,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -539,7 +543,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_cHRM #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -676,7 +680,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) + if (info_ptr != NULL && info_ptr->valid & PNG_INFO_sRGB) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-PNG-2.005/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-PNG-2.005/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-PNG-2.005/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-PNG-2.005/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_debug(1, "in png_handle_hIST\n"); @@@@ -946,14 +950,14 @@@@ return; } - if (length != (png_uint_32)(2 * png_ptr->num_palette)) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); return; } - num = (int)length / 2 ; png_ptr->hist = (png_uint_16p)png_malloc(png_ptr, (png_uint_32)(num * sizeof (png_uint_16))); png_ptr->flags |= PNG_FLAG_FREE_HIST; @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) http://www.graphicsmagick.org/libpng/beta/patches/INFO.txt > [Problems discovered and fixed by] Chris Evans > > 1) Remotely exploitable stack-based buffer overrun in png_handle_tRNS (pngrutil.c) > 2) Dangerous code in png_handle_sBIT (pngrutil.c) CAN-2004-0597 > 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) > this flaw is duplicated in multiple other locations. CAN-2004-0598 > 4) Theoretical integer overflow in allocation in png_handle_sPLT (pngrutil.c) > 5) Integer overflow in png_read_png (pngread.c) > 6) Integer overflows during progressive reading. > 7) Other flaws. [integer overflows] CAN-2004-0599 http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch03-trns-chunk-overflow.txt Use to patch libpng-1.0.9 through 1.2.5 This fixes the most dangerous of the newly reported vulnerabilities diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch03/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c Fri Jul 23 18:54:36 2004 @@@@ -1241,7 +1241,8 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before tRNS"); } - else if (length > (png_uint_32)png_ptr->num_palette) + if (length > (png_uint_32)png_ptr->num_palette || + length > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect tRNS chunk length"); png_crc_finish(png_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch04-get-uint-31.txt Use to patch libpng-1.0.6 through 1.2.5 This patch defines PNG_UINT_31_MAX, PNG_UINT_32_MAX, PNG_SIZE_MAX, and png_get_uint_31(), which are needed by patches 05-08. diff -r -U 3 libpng-1.2.5/png.h libpng-1.2.5patch04/png.h --- Tk-804.025_beta14/PNG/libpng/png.h.orig Thu Oct 3 06:32:26 2002 +++ Tk-804.025_beta14/PNG/libpng/png.h Fri Jul 23 18:56:27 2004 @@@@ -833,7 +833,11 @@@@ typedef png_info FAR * FAR * png_infopp; /* Maximum positive integer used in PNG is (2^31)-1 */ -#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +#define PNG_UINT_31_MAX ((png_uint_32)0x7fffffffL) +#define PNG_UINT_32_MAX (~((png_uint_32)0)) +#define PNG_SIZE_MAX (~((png_size_t)0)) +/* PNG_MAX_UINT is deprecated; use PNG_UINT_31_MAX instead. */ +#define PNG_MAX_UINT PNG_UINT_31_MAX /* These describe the color_type field in png_info. */ /* color type masks */ @@@@ -2655,6 +2659,8 @@@@ PNG_EXTERN png_uint_32 png_get_uint_32 PNGARG((png_bytep buf)); PNG_EXTERN png_uint_16 png_get_uint_16 PNGARG((png_bytep buf)); #endif /* !PNG_READ_BIG_ENDIAN_SUPPORTED */ +PNG_EXTERN png_uint_32 png_get_uint_31 PNGARG((png_structp png_ptr, + png_bytep buf)); /* Initialize png_ptr struct for reading, and allocate any other memory. * (old interface - DEPRECATED - use png_create_read_struct instead). diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch04/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c Fri Jul 23 18:56:27 2004 @@@@ -38,6 +38,14 @@@@ # endif #endif +png_uint_32 /* PRIVATE */ +png_get_uint_31(png_structp png_ptr, png_bytep buf) +{ + png_uint_32 i = png_get_uint_32(buf); + if (i > PNG_UINT_31_MAX) + png_error(png_ptr, "PNG unsigned integer out of range.\n"); + return (i); +} #ifndef PNG_READ_BIG_ENDIAN_SUPPORTED /* Grab an unsigned 32-bit integer from a buffer in big-endian format. */ png_uint_32 /* PRIVATE */ http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch05-pngpread-chunklength.txt Use to patch libpng-1.0.0 through 1.2.5 Requires one of libpng-patch04* diff -r -U 3 libpng-1.2.5/pngpread.c libpng-1.2.5patch05/pngpread.c --- Tk-804.025_beta14/PNG/libpng/pngpread.c.orig Thu Oct 3 06:32:28 2002 +++ Tk-804.025_beta14/PNG/libpng/pngpread.c Fri Jul 23 18:57:39 2004 @@@@ -208,7 +208,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; @@@@ -591,6 +591,11 @@@@ png_size_t new_max; png_bytep old_buffer; + if (png_ptr->save_buffer_size > PNG_SIZE_MAX - + (png_ptr->current_buffer_size + 256)) + { + png_error(png_ptr, "Potential overflow of save_buffer"); + } new_max = png_ptr->save_buffer_size + png_ptr->current_buffer_size + 256; old_buffer = png_ptr->save_buffer; png_ptr->save_buffer = (png_bytep)png_malloc(png_ptr, @@@@ -637,8 +642,7 @@@@ } png_push_fill_buffer(png_ptr, chunk_length, 4); - png_ptr->push_length = png_get_uint_32(chunk_length); - + png_ptr->push_length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_ptr->mode |= PNG_HAVE_CHUNK_HEADER; http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch06-pngread-chunklength.txt Use to patch libpng-1.0.13 through 1.0.15 and 1.2.2 through 1.2.5. Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch06/pngread.c --- Tk-804.025_beta14/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.025_beta14/PNG/libpng/pngread.c Fri Jul 23 18:59:57 2004 @@@@ -384,7 +384,7 @@@@ png_uint_32 length; png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -392,9 +392,6 @@@@ png_debug2(0, "Reading %s chunk, length=%lu.\n", png_ptr->chunk_name, length); - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); - /* This should be a binary subdivision search or a hash for * matching the chunk name rather than a linear search. */ @@@@ -673,10 +670,7 @@@@ png_crc_finish(png_ptr, 0); png_read_data(png_ptr, chunk_length, 4); - png_ptr->idat_size = png_get_uint_32(chunk_length); - - if (png_ptr->idat_size > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); + png_ptr->idat_size = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); @@@@ -946,15 +940,12 @@@@ #endif /* PNG_GLOBAL_ARRAYS */ png_read_data(png_ptr, chunk_length, 4); - length = png_get_uint_32(chunk_length); + length = png_get_uint_31(png_ptr,chunk_length); png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); png_debug1(0, "Reading %s chunk.\n", png_ptr->chunk_name); - - if (length > PNG_MAX_UINT) - png_error(png_ptr, "Invalid chunk length."); if (!png_memcmp(png_ptr->chunk_name, png_IHDR, 4)) png_handle_IHDR(png_ptr, info_ptr, length); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch07-png-read-png-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* diff -r -U 3 libpng-1.2.5/pngread.c libpng-1.2.5patch07/pngread.c --- Tk-804.025_beta14/PNG/libpng/pngread.c.orig Thu Oct 3 06:32:29 2002 +++ Tk-804.025_beta14/PNG/libpng/pngread.c Fri Jul 23 19:01:39 2004 @@@@ -1299,6 +1299,9 @@@@ */ png_read_info(png_ptr, info_ptr); + if (info_ptr->height > PNG_UINT_32_MAX/sizeof(png_bytep)) + png_error(png_ptr,"Image is too high to process with png_read_png()"); + /* -------------- image transformations start here ------------------- */ #if defined(PNG_READ_16_TO_8_SUPPORTED) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch08-splt-buffer-overflow.txt Use to patch libpng-1.0.6 through 1.2.5. Libpng-1.0.5 and earlier didn't implement png_read_png(). Requires libpng-patch04-* The "sPLT chunk too long" check from Matthias Clasen (RedHat libpng package maintainer) diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch08/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c Fri Jul 23 19:02:48 2004 @@@@ -1154,8 +1154,18 @@@@ } new_palette.nentries = data_length / entry_size; - new_palette.entries = (png_sPLT_entryp)png_malloc( + if (new_palette.nentries > PNG_SIZE_MAX / sizeof(png_sPLT_entry)) + { + png_warning(png_ptr, "sPLT chunk too long"); + return; + } + new_palette.entries = (png_sPLT_entryp)png_malloc_warn( png_ptr, new_palette.nentries * sizeof(png_sPLT_entry)); + if (new_palette.entries == NULL) + { + png_warning(png_ptr, "sPLT chunk requires too much memory"); + return; + } #ifndef PNG_NO_POINTER_INDEXING for (i = 0; i < new_palette.nentries; i++) http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch09-null-iccp-profile.txt Use to patch libpng-1.0.9 through 1.2.5. Does not work with libpng-1.0.6-1.0.8. Libpng-1.0.5 and earlier didn't implement iCCP chunk reading. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch09/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c Fri Jul 23 19:04:28 2004 @@@@ -977,8 +977,7 @@@@ png_bytep pC; png_charp profile; png_uint_32 skip = 0; - png_uint_32 profile_size = 0; - png_uint_32 profile_length = 0; + png_uint_32 profile_size, profile_length; png_size_t slength, prefix_length, data_length; png_debug(1, "in png_handle_iCCP\n"); http://www.graphicsmagick.org/libpng/beta/patches/libpng-patch10-find-duplicate-chunk.txt Use to patch libpng-1.0.6 through 1.2.5 Does not work with libpng-1.0.5 and earlier. No security problem. The bugs are similar to the one fixed in patch 03, but the only effect is that libpng will fail to detect misplaced harmless duplicate chunks. diff -r -U 3 libpng-1.2.5/pngrutil.c libpng-1.2.5patch10/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig Thu Oct 3 06:32:30 2002 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c Fri Jul 23 19:05:40 2004 @@@@ -579,7 +579,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place gAMA chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_gAMA) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -660,7 +660,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sBIT chunk"); } - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sBIT)) { png_warning(png_ptr, "Duplicate sBIT chunk"); png_crc_finish(png_ptr, length); @@@@ -729,7 +729,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Missing PLTE before cHRM"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_cHRM) #if defined(PNG_READ_sRGB_SUPPORTED) && !(info_ptr->valid & PNG_INFO_sRGB) #endif @@@@ -891,7 +891,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place sRGB chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_sRGB)) { png_warning(png_ptr, "Duplicate sRGB chunk"); png_crc_finish(png_ptr, length); @@@@ -995,7 +995,7 @@@@ /* Should be an error, but we can cope with it */ png_warning(png_ptr, "Out of place iCCP chunk"); - else if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) + if (info_ptr != NULL && (info_ptr->valid & PNG_INFO_iCCP)) { png_warning(png_ptr, "Duplicate iCCP chunk"); png_crc_finish(png_ptr, length); This patch from Chris Evans avoids a host of security problems related to buffer overflows that might occur when processing very large images. It causes the reader to reject any images claiming to have more rows or columns the png format supports. diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h --- Tk-804.025_beta14/PNG/libpng/png.h.orig 2002-10-03 12:32:26.000000000 +0100 +++ Tk-804.025_beta14/PNG/libpng/png.h 2004-07-13 23:18:10.000000000 +0100 @@@@ -835,6 +835,9 @@@@ /* Maximum positive integer used in PNG is (2^31)-1 */ #define PNG_MAX_UINT ((png_uint_32)0x7fffffffL) +/* Constraints on width, height, (2 ^ 24) - 1*/ +#define PNG_MAX_DIMENSION 16777215 + /* These describe the color_type field in png_info. */ /* color type masks */ #define PNG_COLOR_MASK_PALETTE 1 diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c --- Tk-804.025_beta14/PNG/libpng/pngrutil.c.orig 2004-07-13 13:36:37.000000000 +0100 +++ Tk-804.025_beta14/PNG/libpng/pngrutil.c 2004-07-13 23:43:02.000000000 +0100 @@@@ -350,7 +350,11 @@@@ png_crc_finish(png_ptr, 0); width = png_get_uint_32(buf); + if (width > PNG_MAX_DIMENSION) + png_error(png_ptr, "Width is too large"); height = png_get_uint_32(buf + 4); + if (height > PNG_MAX_DIMENSION) + png_error(png_ptr, "Height is too large"); bit_depth = buf[8]; color_type = buf[9]; compression_type = buf[10]; @@@@ -675,7 +679,7 @@@@ else truelen = (png_size_t)png_ptr->channels; - if (length != truelen) + if (length != truelen || length > 4) { png_warning(png_ptr, "Incorrect sBIT chunk length"); png_crc_finish(png_ptr, length); @@@@ -1400,7 +1405,7 @@@@ void /* PRIVATE */ png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length) { - int num, i; + unsigned int num, i; png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH]; png_debug(1, "in png_handle_hIST\n"); @@@@ -1426,8 +1431,8 @@@@ return; } - num = (int)length / 2 ; - if (num != png_ptr->num_palette) + num = length / 2 ; + if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH) { png_warning(png_ptr, "Incorrect hIST chunk length"); png_crc_finish(png_ptr, length); @@@@ -2868,6 +2873,9 @@@@ png_read_data(png_ptr, chunk_length, 4); png_ptr->idat_size = png_get_uint_32(chunk_length); + if (png_ptr->idat_size > PNG_MAX_UINT) + png_error(png_ptr, "Invalid chunk length."); + png_reset_crc(png_ptr); png_crc_read(png_ptr, png_ptr->chunk_name, 4); if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4)) @ 1.1 log @fully unbreak this package and upgrade to latest module versions @ text @@