[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[bugzilla at redhat.com]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Tomas Hoger <thoger at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
   Fixed In Version|                            |freetype 2.5.4
            Summary|CVE-2014-9670 freetype:     |CVE-2014-9670 freetype:
                   |Multiple integer signedness |integer overflow in
                   |errors in the               |pcf_get_encodings() leading
                   |pcf_get_encodings function  |to NULL pointer dereference
                   |inpcf/pcfread.c             |
         Whiteboard|impact=moderate,public=2014 |impact=low,public=20141124,
                   |1124,reported=20150210,sour |reported=20150210,source=cv
                   |ce=cve,cvss2=3.7/AV:L/AC:H/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |Au:N/C:P/I:P/A:P,fedora-all |C:N/I:N/A:P,cwe=CWE-190->CW
                   |/freetype=affected,rhel-5/f |E-476,rhel-4/freetype=wontf
                   |reetype=new,rhel-6/freetype |ix,rhel-5/freetype=wontfix,
                   |=new,rhel-7/freetype=new    |rhel-6/freetype=affected,rh
                   |                            |el-7/freetype=affected,rhev
                   |                            |-m-3/mingw-virt-viewer=affe
                   |                            |cted,fedora-all/freetype=af
                   |                            |fected,fedora-all/mingw-fre
                   |                            |etype=affected,epel-7/mingw
                   |                            |-freetype=affected
           Severity|medium                      |low



--- Comment #4 from Tomas Hoger <thoger at redhat.com> ---
Upstream bug is:
https://savannah.nongnu.org/bugs/?43548

Issue was fixed upstream in 2.5.4.

Affected code reads 4 short values from the input file.  There are 2 "pairs",
for which difference is computed and 1 added to the difference (basically: last
- first + 1).  Results are multiplied together to produce the number of
encodings.  Resulting value is in the range of 32bit signed integer (-2^31 to
2^31-1).  Negative values cause freetype memory allocation function to return
error, which causes pcf_get_encodings() to exit early.  The value of 0 causes
memory allocation function to return NULL, which is later dereferenced, leading
to crash.  Positive values are ok.  As value of each operand of the
multiplication can not exceed 65536 (i.e. 2^16), result can not exceed 2^32. 
Therefore, this can not lead to allocation of a too small buffer that is later
overflown.  Hence there is no memory corruption / code execution impact.

Note that the integer signedness issue mentioned in the upstream report does
not seem relevant.  The same would be possible if first* and last* variables
were unsigned.

Also noted that the NULL pointer dereference occurs in the code introduced by
this commit:

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0eb6316f

which was added in upstream version 2.4.12.  It does not seem to be possible to
trigger NULL pointer dereference in earlier versions, hence this does not seem
to have any practical impact on the freetype packages in Red Hat Enterprise
Linux 7 and earlier.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bchv8X8hTu&a=cc_unsubscribe