CVE-2016-10168 (published 2017-03-15T15:59Z)

Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Christoph M. Becker
author_date: 2016-12-17 17:06:58+01:00
msg: Fix #354: Signed Integer Overflow gd_io.c

GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
byte unsigned). These values are multiplied and assigned to an int when
reading the image, what can cause integer overflows. We have to avoid
that, and also make sure that either chunk count is actually greater
than zero. If illegal chunk counts are detected, we bail out from
reading the image.
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
file_changes: filename: gd_gd2.c
change_type: ModificationType.MODIFY
diff: @@ -209,6 +209,10 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
 	GD2_DBG (printf ("%d Chunks vertically\n", *ncy));
 
 	if (gd2_compressed (*fmt)) {
+		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+			goto fail1;
+		}
 		nc = (*ncx) * (*ncy);
 
 		GD2_DBG (printf ("Reading %d chunk index entries\n", nc));

programming_language: C
filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 /bug_289
 /bug00309
+/bug00354
 /gd2_empty_file
 /gd2_im2im
 /gd2_null

programming_language: Shell
filename: CMakeLists.txt
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 LIST(APPEND TESTS_FILES
 	bug_289
 	bug00309
+	bug00354
 	gd2_empty_file
 	gd2_im2im
 	gd2_null

programming_language: Batchfile
filename: Makemodule.am
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 libgd_test_programs += \
 	gd2/bug_289 \
 	gd2/bug00309 \
+	gd2/bug00354 \
 	gd2/gd2_empty_file \
 	gd2/php_bug_72339 \
 	gd2/gd2_read_corrupt \
@@ -19,6 +20,8 @@ endif
 
 EXTRA_DIST += \
 	gd2/CMakeLists.txt \
+	gd2/bug00354a.gd2 \
+	gd2/bug00354b.gd2 \
 	gd2/conv_gd2_exp.gd2 \
 	gd2/conv_test.gd2 \
 	gd2/conv_test_exp.png \

programming_language: Shell
filename: bug00354.c
change_type: ModificationType.ADD
diff: @@ -0,0 +1,32 @@
+/**
+ * We're testing GD2 image files which report illegal chunk counts. These should
+ * not cause integer overflows or other issues, but instead simply fail to be
+ * loaded.
+ *
+ * See also <https://github.com/libgd/libgd/issues/354>.
+ */
+
+
+#include "gd.h"
+#include "gdtest.h"
+
+
+int main()
+{
+    gdImagePtr im;
+    FILE *fp;
+
+    fp = gdTestFileOpen2("gd2", "bug00354a.gd2");
+    gdTestAssert(fp != NULL);
+    im = gdImageCreateFromGd2(fp);
+    gdTestAssert(im == NULL);
+    fclose(fp);
+
+    fp = gdTestFileOpen2("gd2", "bug00354b.gd2");
+    gdTestAssert(fp != NULL);
+    im = gdImageCreateFromGd2(fp);
+    gdTestAssert(im == NULL);
+    fclose(fp);
+
+    return gdNumFailures();
+}

programming_language: C++