Bug 17746 - eog new integer overflow security issue (CVE-2013-7447)
Summary: eog new integer overflow security issue (CVE-2013-7447)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/675834/
Whiteboard: has_procedure MGA5-64-OK advisory
Keywords: validated_update
Depends on:
Blocks: 17731
  Show dependency treegraph
 
Reported: 2016-02-12 20:21 CET by David Walser
Modified: 2016-02-17 20:22 CET (History)
4 users (show)

See Also:
Source RPM: eog
CVE:
Status comment:


Attachments
Large image used for eom and eog tests (86.34 KB, image/png)
2016-02-15 16:45 CET, Len Lawrence
Details

Description David Walser 2016-02-12 20:21:42 CET
+++ This bug was initially created as a clone of Bug #17731 +++

A CVE was requested for an integer overflow that affects gtk+ and several apps:
http://openwall.com/lists/oss-security/2016/02/10/2

A commit upstream in gtk+ to fix it is linked in the message above.

Patched eog packages uploaded for Mageia 5 and Cauldron.

Suggested advisory:
========================

Updated eog packages fix security vulnerability:

Due to a logic error, an attempt to allocate a large block of memory
fails in create_surface_from_pixbuf, leading to a crash of eog (CVE-2013-7447).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7447
http://openwall.com/lists/oss-security/2016/02/10/6
========================

Updated packages in core/updates_testing:
========================
eog-3.14.3-1.1.mga5
libeog-gir3.0-3.14.3-1.1.mga5
eog-devel-3.14.3-1.1.mga5

from eog-3.14.3-1.1.mga5.src.rpm
Comment 1 Lewis Smith 2016-02-12 20:54:38 CET
Testing MGA5 x64 real h/w: OK

Curiosity: Despite already having and using occasdionally EOG, I did not have lib64eog-gir3.0 . I installed it for the update, but clearly it is not being used here.

Updated to: lib64eog-gir3.0-3.14.3-1.1.mga5      eog-3.14.3-1.1.mga5

Viewed a mixed bag of image types, fullscreen, slideshow, all seems OK.

CC: (none) => lewyssmith
Whiteboard: (none) => MGA5-64-OK

Comment 2 Len Lawrence 2016-02-15 11:49:38 CET
mga5  i586 in virtualbox  Mate

Before updating ran a check on a large PNG file (27000x27000).
The image displayed for several seconds then vanished:
[lcl@cursa ~]$ eog big.png
**
Gdk:ERROR:gdkcairo.c:193:gdk_cairo_surface_paint_pixbuf: assertion failed: (cairo_image_surface_get_format (surface) == CAIRO_FORMAT_RGB24 || cairo_image_surface_get_format (surface) == CAIRO_FORMAT_ARGB32)
Abort

Performed the update and tested eog against several different image types.  Used the image and display manipulation functions, ran the slideshow and edited preferences to alter the period.  Everything working fine except with the 27000x27000 PNG image.  It rendered alright but crashed after 4 or 5 seconds.  That looks similar to bug #17739 which was fixed for eom.  The current problem manifests itself on x86_64 as well.

However eog looks good for this update.

CC: (none) => tarazed25

Len Lawrence 2016-02-15 11:50:19 CET

Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Len Lawrence 2016-02-15 11:51:45 CET

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 3 Len Lawrence 2016-02-15 11:58:47 CET
Sorry, I have to retract that.  Somehow overlooked the point of the update.  The big.png test is the PoC and shows that the update does not fix the problem.

Keywords: validated_update => (none)

Len Lawrence 2016-02-15 11:58:58 CET

Whiteboard: MGA5-64-OK MGA5-32-OK => MGA5-64-OK

Comment 4 Len Lawrence 2016-02-15 12:52:08 CET
@Lewis.  And apologies to you also - I am going to have to cancel the 64bit OK.

After updating eog and lib64eog-gir3.0:
[lcl@vega ~]$ eog big.png

(eog:2269): Gdk-WARNING **: eog: Fatal IO error 2 (No such file or directory) on X server :2.

eog tried to render the image but failed after a few seconds.  The point of failure looks different from that encountered in the 32bit test so may well be a different bug.  Shall file a new bug against it with an strace and see what transpires.

All other tests succeed so I am in a bit of a quandary about the status of this update for 64bits.  Has the original bug been squashed or not?  Safer to let it stand.
Comment 5 Lewis Smith 2016-02-15 13:46:45 CET
(In reply to Len Lawrence from comment #4)
> @Lewis.  And apologies to you also - I am going to have to cancel the 64bit
> OK.
Quite agree. You have done a marvelous job here, much more thorough than mine. I overlooked the "memory allocation integer overflow in gdk_cairo_set_source_pixbuf on large pixbufs" issue. Well dug out.
 http://openwall.com/lists/oss-security/2016/02/10/6 ->
 https://bugzilla.gnome.org/show_bug.cgi?id=703220
Not sure about whether whether to let this bug stand 'awaiting feedback' i.e. another correction; or squash it until that correction arrives, new bug. David will know.
Comment 6 Len Lawrence 2016-02-15 16:45:51 CET
Created attachment 7462 [details]
Large image used for eom and eog tests
Len Lawrence 2016-02-15 16:50:54 CET

Whiteboard: MGA5-64-OK => (none)

Comment 7 Len Lawrence 2016-02-15 16:52:44 CET
Bug https://bugs.mageia.org/show_bug.cgi?id=17778 filed for the error report noted in comment #4.
Comment 8 David Walser 2016-02-15 17:02:15 CET
So how do the outputs/traces compare before and after the update?  Is there a difference between 32-bit and 64-bit?
Comment 9 Len Lawrence 2016-02-15 17:42:48 CET
Only one of the tests has an strace file.
Terminal output:
i586 VM
Before update:
**
Gdk:ERROR:gdkcairo.c:193:gdk_cairo_surface_paint_pixbuf: assertion failed: (cairo_image_surface_get_format (surface) == CAIRO_FORMAT_RGB24 || cairo_image_surface_get_format (surface) == CAIRO_FORMAT_ARGB32)
Abort

Afterwards:
(eog:2269): Gdk-WARNING **: eog: Fatal IO error 2 (No such file or directory) on X server :2.


x86_64 both before and afterwards:
(eog:30041): Gdk-WARNING **: eog: Fatal IO error 2 (No such file or directory) on X server :2.0.

For x86_64 I had no record of the before update message so downgraded and  tried the test again and found the same behaviour.

Tried this for the before update version on 64-bit hardware:
[lcl@vega ~]$ gthumb big.png
(gthumb:31361): Gtk-WARNING **: Failed to register client: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.gnome.SessionManager was not provided by any .service files

(gthumb:31361): Gtk-CRITICAL **: gtk_widget_set_visible: assertion 'GTK_IS_WIDGET (widget)' failed
Segmentation fault

which makes me wonder if things might be different on the GNOME desktop.
Off to try that....
Comment 10 David Walser 2016-02-15 17:45:38 CET
Thanks for the confirmation, that's the results that I expected.  I would expect this overflow to only reasonably be able to be triggered on 32-bit, and you showed that it is fixed, but uncovered another bug.  It'd be helpful to know if the new bug you uncovered still exists in Cauldron.
Comment 11 Len Lawrence 2016-02-15 18:11:55 CET
Going native had no effect on x86_64.  i.e. The error message was the same for eog.  So that is an OK for 64-bit systems.
Thanks for the clarification David.
Len Lawrence 2016-02-15 18:12:28 CET

Whiteboard: (none) => has_procedure MGA5-64-OK

David Walser 2016-02-16 20:25:21 CET

URL: (none) => http://lwn.net/Vulnerabilities/675834/

Comment 12 Len Lawrence 2016-02-17 01:01:50 CET
Sorry David.  I don't have a Cauldron installation any more.  I was thinking of taking a break and rebuilding it.  Will report back on one of the mailing lists unless somebody beats me to it.
Comment 13 Len Lawrence 2016-02-17 03:57:13 CET
I might as well report it here as well.  Cauldron installed:
eog-3.19.90-1.mga6
This displays the big.png but without the window frame and menu and it crashes after several seconds with -
(eog:8426): Gdk-WARNING **: eog: Fatal IO error 2 (No such file or directory) on X server :0.

So the bug has propagated to later versions.
eom faults in the same way after successfully displaying the image (with the window decorations in this case).
$ eom big.png
eom: Fatal IO error 2 (No such file or directory) on X server :0.

I shall run an strace in the morning and add this report to bugzilla.
Middle of the night here.
Dave Hodgins 2016-02-17 17:37:46 CET

Keywords: (none) => validated_update
CC: (none) => davidwhodgins
Whiteboard: has_procedure MGA5-64-OK => has_procedure MGA5-64-OK advisory

Comment 14 Mageia Robot 2016-02-17 20:22:41 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0074.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.