Bugzilla – Bug 1027025
VUL-1: CVE-2017-6314: gdk-pixbuf: Infinite loop in io-tiff.c
Last modified: 2022-01-23 14:33:03 UTC
http://seclists.org/oss-sec/2017/q1/466 2. Infinite loop in io-tiff.c [2] --------------------------------- This loader for tiff images will try and allocate a buffer as big as size given to it. It calls the make_available_at_least function to do that. The problem is in the function itself (from line 499): if (need_alloc > context->allocated) { guint new_size = 1; while (new_size < need_alloc) new_size *= 2; ... new_size starts with 1 and multiplies until it is larger or equal to need_alloc. If need_alloc is larger than 2^31, new_size will become 2^31 and multiply itself in 2, and become 0. This would lead to an infinite loop. CVE-2017-6314
https://bugzilla.gnome.org/show_bug.cgi?id=779020
bugbot adjusting priority
no testcase or patch in gnome bug so far. A check against INT_MAX or similar might be useful.
Hi Yifan, can you have someone on your team take this.
Hi Xiaoguang, Would you help to take care of this, thank you!
SUSE-SU-2017:2381-1: An update that solves 5 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1027024,1027025,1027026,1048289,1048544,1049877 CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Server 12-SP3 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Server 12-SP2 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Desktop 12-SP3 (src): gdk-pixbuf-2.34.0-19.5.1 SUSE Linux Enterprise Desktop 12-SP2 (src): gdk-pixbuf-2.34.0-19.5.1
openSUSE-SU-2017:2393-1: An update that solves 5 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1027024,1027025,1027026,1048289,1048544,1049877 CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314 Sources used: openSUSE Leap 42.3 (src): gdk-pixbuf-2.34.0-10.1 openSUSE Leap 42.2 (src): gdk-pixbuf-2.34.0-7.3.1
Closing as fixed.
SUSE-SU-2018:2470-1: An update that solves 5 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1027024,1027025,1027026,1039465,1048289,1048544 CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): gtk2-2.18.9-0.45.8.1 SUSE Linux Enterprise Server 11-SP4 (src): gtk2-2.18.9-0.45.8.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): gtk2-2.18.9-0.45.8.1
we are still tracking this unfixed for SLE-11 gdk-pixbuf
The relevant code isn't in SLE-11 gdk-pixbuf. In newer versions of gdk-pixbuf/gtk2, make_available_at_least is called by gdk_pixbuf_tiff_image_load_increment, but, in SLE-11 gdk-pixbuf, that function just calls fwrite and doesn't do any memory allocation.
done