CVE-2016-6214 (published 2016-08-12T15:59Z)

gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Christoph M. Becker
author_date: 2016-07-12 19:23:13+02:00
msg: Unsupported TGA bpp/alphabit combinations should error gracefully

Currently, only 24bpp without alphabits and 32bpp with 8 alphabits are
really supported. All other combinations will be rejected with a warning.
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
file_changes: filename: gd_tga.c
change_type: ModificationType.MODIFY
diff: @@ -99,7 +99,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromTgaCtx(gdIOCtx* ctx)
 			if (tga->bits == TGA_BPP_24) {
 				*tpix = gdTrueColor(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret]);
 				bitmap_caret += 3;
-			} else if (tga->bits == TGA_BPP_32 || tga->alphabits) {
+			} else if (tga->bits == TGA_BPP_32 && tga->alphabits) {
 				register int a = tga->bitmap[bitmap_caret + 3];
 
 				*tpix = gdTrueColorAlpha(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret], gdAlphaMax - (a >> 1));
@@ -159,16 +159,12 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga)
 	printf("wxh: %i %i\n", tga->width, tga->height);
 #endif
 
-	switch(tga->bits) {
-	case 8:
-	case 16:
-	case 24:
-	case 32:
-		break;
-	default:
-		gd_error("bps %i not supported", tga->bits);
+	if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0)
+		|| (tga->bits == TGA_BPP_32 && tga->alphabits == 8)))
+	{
+		gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n",
+			tga->bits, tga->alphabits);
 		return -1;
-		break;
 	}
 
 	tga->ident = NULL;

programming_language: C
filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,4 @@
 /bug00084
 /bug00247
+/bug00247a
 /tga_null

programming_language: Shell
filename: CMakeLists.txt
change_type: ModificationType.MODIFY
diff: @@ -2,6 +2,7 @@ LIST(APPEND TESTS_FILES
 	tga_null
 	bug00084
 	bug00247
+	bug00247a
 )
 
 ADD_GD_TESTS()

programming_language: Batchfile
filename: Makemodule.am
change_type: ModificationType.MODIFY
diff: @@ -1,9 +1,11 @@
 libgd_test_programs += \
 	tga/bug00084 \
 	tga/bug00247 \
+	tag/bug00247a \
 	tga/tga_null
 
 EXTRA_DIST += \
 	tga/CMakeLists.txt \
 	tga/bug00084.tga \
-	tga/bug00247.tga
+	tga/bug00247.tga \
+	tga/bug00247a.tga

programming_language: Shell
filename: bug00247a.c
change_type: ModificationType.ADD
diff: @@ -0,0 +1,19 @@
+/*
+We test that a 8bpp TGA file will be gracefully rejected by
+gdImageCreateFromTga().
+*/
+
+#include <stdio.h>
+
+#include "gd.h"
+#include "gdtest.h"
+
+int main(int argc, char **argv)
+{
+    gdImagePtr im;
+    FILE *fp = gdTestFileOpen("tga/bug00247a.tga");
+    im = gdImageCreateFromTga(fp);
+    gdTestAssert(im == NULL);
+    fclose(fp);
+    return gdNumFailures();
+}

programming_language: C