CVE-2023-40032 (published 2023-09-11T19:15Z)

libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.\n

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/libvips/libvips
commit_details: repo_url: https://github.com/libvips/libvips
author: Kleis Auke Wolthuizen
author_date: 2023-08-13 15:48:54+02:00
msg: svgload: fix null-pointer dereference (#3604)

`g_utf8_find_next_char()` might return NULL when called with a
non-NULL second argument, indicating that the end of the string
has been reached.
repository: repo_url: https://github.com/libvips/libvips
repo_name: libvips/libvips
description: A fast image processing library with low memory needs.
repo_language: C
owner: libvips
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+TBD 8.14.4
+
+- fix null-pointer dereference during svgload [kleisauke]
+
 20/7/23 8.14.3
 
 - fix ICC handling of greyscale images with a incompatible profile [kleisauke]

programming_language: Markdown
filename: svgload.c
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@ vips_foreign_load_svg_zfree( void *opaque, void *ptr )
 /* Find a utf-8 substring within the first len_bytes (not characters). 
  *
  *   - case-insensitive
- *   - needle must be zero-terminated, but hackstack need not be
+ *   - needle must be zero-terminated, but haystack need not be
  *   - haystack can be null-terminated
  *   - if haystack is shorter than len bytes, that'll end the search 
  *   - if we hit invalid utf-8, we return NULL
@@ -191,11 +191,14 @@ vips_utf8_strcasestr( const char *haystack_start, const char *needle_start,
 				b == (gunichar) -2 )
                                 return( NULL );
 
-                        /* End of haystack. There can't be a complete needle
-                         * anywhere.
+                        /* Disallow codepoint U+0000 as it's a nul byte.
+                         * This is redundant with GLib >= 2.63.0, see:
+                         * https://gitlab.gnome.org/GNOME/glib/-/merge_requests/967
                          */
+#if !GLIB_CHECK_VERSION( 2, 63, 0 )
                         if( a == (gunichar) 0 )
                                 return( NULL );
+#endif
 
                         /* Mismatch.
                          */
@@ -205,6 +208,15 @@ vips_utf8_strcasestr( const char *haystack_start, const char *needle_start,
                         haystack_char = 
 				g_utf8_find_next_char( haystack_char, 
 					haystack_start + len_bytes );
+
+                        /* End of haystack. There can't be a complete needle
+                         * anywhere.
+                         */
+                        if( haystack_char == NULL )
+                                return( NULL );
+
+                        /* needle_char will never be NULL.
+                         */
                         needle_char = 
 				g_utf8_find_next_char( needle_char, NULL );
                 }

programming_language: C