CVE-2013-4160 (published 2014-01-21T18:55Z)

Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mm2/Little-CMS
commit_details: repo_url: https://github.com/mm2/Little-CMS
author: Marti Maria
author_date: 2013-06-25 16:09:16+02:00
msg: Non happy-path fixes
repository: repo_url: https://github.com/mm2/Little-CMS
repo_name: mm2/Little-CMS
description: A free, open source, CMM engine. It provides fast transforms between ICC profiles.
repo_language: C
owner: mm2
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -120,6 +120,7 @@ Added support for VS2012
 Added a simple project for cppcheck
 Rendering intent used when creating the transform is now propagated to profile header in cmsTransform2Devicelink. This is because 7.2.15 in spec 4.3
 Transform2Devicelink now keeps white point when guessing deviceclass is enabled
+Added some checks for non-happy path, mostly failing mallocs
 
 -----------------------
 2.5 Maintenance release

programming_language: Markdown
filename: cmsnamed.c
change_type: ModificationType.MODIFY
diff: @@ -517,8 +517,8 @@ cmsNAMEDCOLORLIST* CMSEXPORT cmsAllocNamedColorList(cmsContext ContextID, cmsUIn
     while (v -> Allocated < n)
         GrowNamedColorList(v);
 
-    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix));
-    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix));
+    strncpy(v ->Prefix, Prefix, sizeof(v ->Prefix)-1);
+    strncpy(v ->Suffix, Suffix, sizeof(v ->Suffix)-1);
     v->Prefix[32] = v->Suffix[32] = 0;
 
     v -> ColorantCount = ColorantCount;
@@ -577,9 +577,7 @@ cmsBool  CMSEXPORT cmsAppendNamedColor(cmsNAMEDCOLORLIST* NamedColorList,
 
     if (Name != NULL) {
 
-        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name,
-                    sizeof(NamedColorList ->List[NamedColorList ->nColors].Name));
-
+        strncpy(NamedColorList ->List[NamedColorList ->nColors].Name, Name, cmsMAX_PATH-1);
         NamedColorList ->List[NamedColorList ->nColors].Name[cmsMAX_PATH-1] = 0;
 
     }
@@ -735,6 +733,10 @@ cmsSEQ* CMSEXPORT cmsAllocProfileSequenceDescription(cmsContext ContextID, cmsUI
     Seq -> seq      = (cmsPSEQDESC*) _cmsCalloc(ContextID, n, sizeof(cmsPSEQDESC));
     Seq -> n        = n;
 
+    if (Seq -> seq == NULL) {
+        _cmsFree(ContextID, Seq);
+        return NULL;
+    }
 
     for (i=0; i < n; i++) {
         Seq -> seq[i].Manufacturer = NULL;

programming_language: C++
filename: cmsopt.c
change_type: ModificationType.MODIFY
diff: @@ -1179,6 +1179,16 @@ Curves16Data* CurvesAlloc(cmsContext ContextID, int nCurves, int nElements, cmsT
 
         c16->Curves[i] = _cmsCalloc(ContextID, nElements, sizeof(cmsUInt16Number));
 
+        if (c16->Curves[i] == NULL) {
+
+            for (j=0; j < i; j++) {
+                _cmsFree(ContextID, c16->Curves[j]);
+            }
+            _cmsFree(ContextID, c16->Curves);
+            _cmsFree(ContextID, c16);
+            return NULL;
+        }
+
         if (nElements == 256) {
 
             for (j=0; j < nElements; j++) {

programming_language: C