CVE-2017-8326 (published 2017-04-29T20:59Z)

libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-682
cwe_name: Incorrect Calculation
description: The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
extended_description: When product performs a security-critical calculation incorrectly, it might lead to incorrect resource allocations, incorrect privilege assignments, or failed comparisons among other things. Many of the direct results of an incorrect calculation can lead to even larger problems such as failed protection mechanisms or even arbitrary code execution.
         

Fix information:
repo_url: https://github.com/jsummers/imageworsener
commit_details: repo_url: https://github.com/jsummers/imageworsener
author: Jason Summers
author_date: 2017-04-22 08:50:41-04:00
msg: Trying to fix some invalid left shift operations

Fixes issue #16
repository: repo_url: https://github.com/jsummers/imageworsener
repo_name: jsummers/imageworsener
description: A utility for processing PNG, JPEG, BMP, and WebP images. Features include resize/resample, dither, grayscale, apply background color, subpixel rendering.
repo_language: C
owner: jsummers
file_changes: filename: imagew-bmp.c
change_type: ModificationType.MODIFY
diff: @@ -425,7 +425,7 @@ static int find_high_bit(unsigned int x)
 {
 	int i;
 	for(i=31;i>=0;i--) {
-		if(x&(1<<i)) return i;
+		if(x&(1U<<(unsigned int)i)) return i;
 	}
 	return 0;
 }
@@ -433,7 +433,7 @@ static int find_low_bit(unsigned int x)
 {
 	int i;
 	for(i=0;i<=31;i++) {
-		if(x&(1<<i)) return i;
+		if(x&(1U<<(unsigned int)i)) return i;
 	}
 	return 0;
 }

programming_language: C
filename: imagew-util.c
change_type: ModificationType.MODIFY
diff: @@ -402,27 +402,30 @@ IW_IMPL(void) iw_set_ui32be(iw_byte *b, unsigned int n)
 
 IW_IMPL(unsigned int) iw_get_ui16le(const iw_byte *b)
 {
-	return b[0] | (b[1]<<8);
+	return (unsigned int)b[0] | ((unsigned int)b[1]<<8);
 }
 
 IW_IMPL(unsigned int) iw_get_ui32le(const iw_byte *b)
 {
-	return b[0] | (b[1]<<8) | (b[2]<<16) | (b[3]<<24);
+	return (unsigned int)b[0] | ((unsigned int)b[1]<<8) |
+		((unsigned int)b[2]<<16) | ((unsigned int)b[3]<<24);
 }
 
 IW_IMPL(int) iw_get_i32le(const iw_byte *b)
 {
-	return (iw_int32)(iw_uint32)(b[0] | (b[1]<<8) | (b[2]<<16) | (b[3]<<24));
+	return (iw_int32)(iw_uint32)((unsigned int)b[0] | ((unsigned int)b[1]<<8) |
+		((unsigned int)b[2]<<16) | ((unsigned int)b[3]<<24));
 }
 
 IW_IMPL(unsigned int) iw_get_ui16be(const iw_byte *b)
 {
-	return (b[0]<<8) | b[1];
+	return ((unsigned int)b[0]<<8) | (unsigned int)b[1];
 }
 
 IW_IMPL(unsigned int) iw_get_ui32be(const iw_byte *b)
 {
-	return (b[0]<<24) | (b[1]<<16) | (b[2]<<8) | b[3];
+	return ((unsigned int)b[0]<<24) | ((unsigned int)b[1]<<16) |
+		((unsigned int)b[2]<<8) | (unsigned int)b[3];
 }
 
 // Accepts a flag indicating the endianness.

programming_language: C