Version: (using KDE KDE 3.4.0) Installed from: I Don't Know OS: Linux Tried on the Debian testing of a colleague, should be up to date, I ignore the exact version. Some corrupt PCX files crash gwenview badly and it could maybe be exploitable. To see in action try loading http://pobox.com/~newt/test/overflow-8.pcx 15561 bytes http://pobox.com/~newt/test/overflow-24.pcx 40334 bytes That are slightly changed from the valid PCX files http://pobox.com/~newt/test/grass-8.pcx 15561 bytes http://pobox.com/~newt/test/grass-24.pcx 40334 bytes If you could mark that bug confidential that would be nice, people could try exploit this. There will be an advisory about that later (there are other programs suffering the same problem).
Created an attachment (id=10321) [details] Zip containing test images Sorry the URL in the report are not valid anymore
Nah, seems to be a false alert. No security problem, just a normal crash. The images have large dimensions, so QImage creation fails, QImage::scanLine() returns NULL and the NULL pointer is used for writing. Nothing else, I don't see how this could be exploitable.
OK this is not too bad, some other package use a wrapped around value for malloc() then proceed to write in non allocated memory. If no calculation is made using dimensions you are quite safe, you should just maybe add a check because file length is obviously not in sync with the alleged image size...
I think there might be a problem if BytesPerLine is larger than w See also attached image that I found on the web.
Created an attachment (id=10324) [details] BABYQUIL.PCX
Created an attachment (id=10325) [details] kimgio_pcx.patch Patch, please review carefully for correctness.
Created an attachment (id=10326) [details] kdelibs/kimgio patch This should take care of the missing checks after QImage creation. But Waldo is right about the potentional problem.
fixed by security update last week.
You need to log in before you can comment on or make changes to this bug.
KDE Bug Tracking System
KDE Bug Tracking System 