[Bug 56590] New: Buffer Overflow in jpeg_decoder_initialize
https://bugs.winehq.org/show_bug.cgi?id=56590 Bug ID: 56590 Summary: Buffer Overflow in jpeg_decoder_initialize Product: Wine Version: 9.7 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: windowscodecs Assignee: wine-bugs(a)winehq.org Reporter: franco(a)blackwinghq.com Distribution: --- The vulnerable jpeg_decoder_initialize function in file libjpeg.c (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.c...) is used to decompress jpegs and create a raw bitmap version of the image. In jpeg_decoder_initialize, the values for cinfo.output_width and cinfo.output_height are retrieved directly from a jpeg file's header. cinfo.output_width and cinfo.output_height can be manipulated by editing the header of the jpeg file being processed. They are two bytes each in the image's header so their values can range from 0x0000 to 0xFFFF. These variables are multiplied with frame.bpp. When these three values are multiplied together they can exceed the limit of a 32-bit unsigned integer, leading to an integer overflow vulnerability. This product is used to set the size of the image_data buffer, which will store the decompressed jpeg (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.c...). When the sizing arguments overflow, the buffer becomes too small to store the decompressed data. The program writes the decompressed image to the buffer using the jpeg_read_scanlines function. The function ends up writing to out-of-bounds memory due to the buffer’s small size (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.c...). This causes data in memory adjacent to the buffer to be overwritten. An attacker is in control of the image's height, width, and contents. This allows an attacker to craft an exploit to overwrite data in memory with data they control. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56590 Ken Sharp <imwellcushtymelike(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, source -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56590 --- Comment #1 from Esme Povirk <madewokherd(a)gmail.com> --- Hi, do you have an example image I can use for testing? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56590 --- Comment #2 from Esme Povirk <madewokherd(a)gmail.com> --- MR created: https://gitlab.winehq.org/wine/wine/-/merge_requests/5548 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56590 Fabian Maurer <dark.shadow4(a)web.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dark.shadow4(a)web.de --- Comment #3 from Fabian Maurer <dark.shadow4(a)web.de> --- It's merged, is this fixed now? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56590 Esme Povirk <madewokherd(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |madewokherd(a)gmail.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=56590 Esme Povirk <madewokherd@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEEDINFO Ever confirmed|0 |1 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
WineHQ Bugzilla -
WineHQ Bugzilla