Please sync potrace 1.12-1 from Debian Unstable (main)
Bug #1443467 reported by
Alex Valavanis
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
potrace (Debian) |
Fix Released
|
Unknown
|
|||
potrace (Fedora) |
Invalid
|
Low
|
|||
potrace (Ubuntu) |
Fix Released
|
High
|
Unassigned |
Bug Description
This is required to fix a heap overflow issue (fixed upstream in potrace 1.12).
please see https:/
CVE-2013-7437: http://
CVE References
Changed in potrace (Debian): | |
status: | Unknown → Fix Released |
information type: | Public → Public Security |
Changed in potrace (Fedora): | |
importance: | Unknown → Low |
status: | Unknown → Invalid |
To post a comment you must log in.
Murray McAllister of the Red Hat Security Response Team reported the following potential vulnerability in potrace:
There is a possible issue in potrace- 1.11-1. fc18.x86_ 64. The attached
bmp file (1.bmp) triggers it. I suspect less memory is allocated than
expected in bm_new() due to integer overflow. I have not investigated it
closely or the rest of the application yet.
$ potrace 1.bmp libc.so. 6[0x3c6de7ca8e] libpotrace. so.0[0x354ae061 2f] libpotrace. so.0(potrace_ trace+0x106) [0x354ae06356] libc.so. 6(__libc_ start_main+ 0xf5)[0x3c6de21 a05]
*** glibc detected *** potrace: free(): invalid next size (fast):
0x0000000001263580 ***
======= Backtrace: =========
/usr/lib64/
/usr/lib64/
/usr/lib64/
potrace[0x40361b]
potrace[0x402c9f]
/usr/lib64/
potrace[0x40303d]
..
==2042== Memcheck, a memory error detector malloc. c:270) malloc. c:270) malloc. c:270) malloc. c:270)
==2042== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==2042== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==2042== Command: potrace 1.bmp
==2042==
==2042== Invalid read of size 8
==2042== at 0x405F2D: bm_read (bitmap_io.c:615)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042== Address 0x4c14680 is 0 bytes after a block of size 0 alloc'd
==2042== at 0x4A0887C: malloc (vg_replace_
==2042== by 0x405069: bm_read (bitmap.h:66)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042==
==2042== Invalid write of size 8
==2042== at 0x405F31: bm_read (bitmap_io.c:615)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042== Address 0x4c14680 is 0 bytes after a block of size 0 alloc'd
==2042== at 0x4A0887C: malloc (vg_replace_
==2042== by 0x405069: bm_read (bitmap.h:66)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042==
==2042== Invalid read of size 8
==2042== at 0x405585: bm_read (bitmap_io.c:615)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042== Address 0x4c14688 is 8 bytes after a block of size 0 alloc'd
==2042== at 0x4A0887C: malloc (vg_replace_
==2042== by 0x405069: bm_read (bitmap.h:66)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042==
==2042== Invalid write of size 8
==2042== at 0x405589: bm_read (bitmap_io.c:615)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042== Address 0x4c14688 is 8 bytes after a block of size 0 alloc'd
==2042== at 0x4A0887C: malloc (vg_replace_
==2042== by 0x405069: bm_read (bitmap.h:66)
==2042== by 0x4035A0: process_file.isra.3 (main.c:1056)
==2042== by 0x402C9E: main (main.c:1212)
==2042==
potrace: warning: 1.bmp: premature end of file
valgrind: m_mallocfree.c:268 (mk_plain_bszB): Assertion 'bszB != 0' failed.
valgrind: This is probably caused by your program erroneously writing
past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by ...