Blame SOURCES/0002-Fix-CVE-2022-44617-Runaway-loop-with-width-of-0-and-.patch

2824cf
From 52603840b1c5d923cc998335fb651a53d42a036c Mon Sep 17 00:00:00 2001
2824cf
From: Alan Coopersmith <alan.coopersmith@oracle.com>
2824cf
Date: Sat, 7 Jan 2023 12:44:28 -0800
2824cf
Subject: [PATCH libXpm 2/5] Fix CVE-2022-44617: Runaway loop with width of 0
2824cf
 and enormous height
2824cf
2824cf
When reading XPM images from a file with libXpm 3.5.14 or older, if a
2824cf
image has a width of 0 and a very large height, the ParsePixels() function
2824cf
will loop over the entire height calling getc() and ungetc() repeatedly,
2824cf
or in some circumstances, may loop seemingly forever, which may cause a
2824cf
denial of service to the calling program when given a small crafted XPM
2824cf
file to parse.
2824cf
2824cf
Closes: #2
2824cf
2824cf
Reported-by: Martin Ettl <ettl.martin78@googlemail.com>
2824cf
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2824cf
---
2824cf
 src/data.c  | 20 ++++++++++++++------
2824cf
 src/parse.c | 31 +++++++++++++++++++++++++++----
2824cf
 2 files changed, 41 insertions(+), 10 deletions(-)
2824cf
2824cf
diff --git a/src/data.c b/src/data.c
2824cf
index bfad4ff..7524e65 100644
2824cf
--- a/src/data.c
2824cf
+++ b/src/data.c
2824cf
@@ -195,19 +195,23 @@ xpmNextString(xpmData *data)
2824cf
 	register char c;
2824cf
 
2824cf
 	/* get to the end of the current string */
2824cf
-	if (data->Eos)
2824cf
-	    while ((c = *data->cptr++) && c != data->Eos);
2824cf
+	if (data->Eos) {
2824cf
+	    while ((c = *data->cptr++) && c != data->Eos && c != '\0');
2824cf
+
2824cf
+	    if (c == '\0')
2824cf
+		return XpmFileInvalid;
2824cf
+	}
2824cf
 
2824cf
 	/*
2824cf
 	 * then get to the beginning of the next string looking for possible
2824cf
 	 * comment
2824cf
 	 */
2824cf
 	if (data->Bos) {
2824cf
-	    while ((c = *data->cptr++) && c != data->Bos)
2824cf
+	    while ((c = *data->cptr++) && c != data->Bos && c != '\0')
2824cf
 		if (data->Bcmt && c == data->Bcmt[0])
2824cf
 		    ParseComment(data);
2824cf
 	} else if (data->Bcmt) {	/* XPM2 natural */
2824cf
-	    while ((c = *data->cptr++) == data->Bcmt[0])
2824cf
+	    while (((c = *data->cptr++) == data->Bcmt[0]) && c != '\0')
2824cf
 		ParseComment(data);
2824cf
 	    data->cptr--;
2824cf
 	}
2824cf
@@ -216,9 +220,13 @@ xpmNextString(xpmData *data)
2824cf
 	FILE *file = data->stream.file;
2824cf
 
2824cf
 	/* get to the end of the current string */
2824cf
-	if (data->Eos)
2824cf
+	if (data->Eos) {
2824cf
 	    while ((c = Getc(data, file)) != data->Eos && c != EOF);
2824cf
 
2824cf
+	    if (c == EOF)
2824cf
+		return XpmFileInvalid;
2824cf
+	}
2824cf
+
2824cf
 	/*
2824cf
 	 * then get to the beginning of the next string looking for possible
2824cf
 	 * comment
2824cf
@@ -234,7 +242,7 @@ xpmNextString(xpmData *data)
2824cf
 	    Ungetc(data, c, file);
2824cf
 	}
2824cf
     }
2824cf
-    return 0;
2824cf
+    return XpmSuccess;
2824cf
 }
2824cf
 
2824cf
 
2824cf
diff --git a/src/parse.c b/src/parse.c
2824cf
index c19209c..e97d771 100644
2824cf
--- a/src/parse.c
2824cf
+++ b/src/parse.c
2824cf
@@ -391,6 +391,13 @@ ParsePixels(
2824cf
 {
2824cf
     unsigned int *iptr, *iptr2 = NULL; /* found by Egbert Eich */
2824cf
     unsigned int a, x, y;
2824cf
+    int ErrorStatus;
2824cf
+
2824cf
+    if ((width == 0) && (height != 0))
2824cf
+	return (XpmFileInvalid);
2824cf
+
2824cf
+    if ((height == 0) && (width != 0))
2824cf
+	return (XpmFileInvalid);
2824cf
 
2824cf
     if ((height > 0 && width >= UINT_MAX / height) ||
2824cf
 	width * height >= UINT_MAX / sizeof(unsigned int))
2824cf
@@ -428,7 +435,11 @@ ParsePixels(
2824cf
 		colidx[(unsigned char)colorTable[a].string[0]] = a + 1;
2824cf
 
2824cf
 	    for (y = 0; y < height; y++) {
2824cf
-		xpmNextString(data);
2824cf
+		ErrorStatus = xpmNextString(data);
2824cf
+		if (ErrorStatus != XpmSuccess) {
2824cf
+		    XpmFree(iptr2);
2824cf
+		    return (ErrorStatus);
2824cf
+		}
2824cf
 		for (x = 0; x < width; x++, iptr++) {
2824cf
 		    int c = xpmGetC(data);
2824cf
 
2824cf
@@ -475,7 +486,11 @@ do \
2824cf
 	    }
2824cf
 
2824cf
 	    for (y = 0; y < height; y++) {
2824cf
-		xpmNextString(data);
2824cf
+		ErrorStatus = xpmNextString(data);
2824cf
+		if (ErrorStatus != XpmSuccess) {
2824cf
+		    XpmFree(iptr2);
2824cf
+		    return (ErrorStatus);
2824cf
+		}
2824cf
 		for (x = 0; x < width; x++, iptr++) {
2824cf
 		    int cc1 = xpmGetC(data);
2824cf
 		    if (cc1 > 0 && cc1 < 256) {
2824cf
@@ -515,7 +530,11 @@ do \
2824cf
 		xpmHashAtom *slot;
2824cf
 
2824cf
 		for (y = 0; y < height; y++) {
2824cf
-		    xpmNextString(data);
2824cf
+		    ErrorStatus = xpmNextString(data);
2824cf
+		    if (ErrorStatus != XpmSuccess) {
2824cf
+			XpmFree(iptr2);
2824cf
+			return (ErrorStatus);
2824cf
+		    }
2824cf
 		    for (x = 0; x < width; x++, iptr++) {
2824cf
 			for (a = 0, s = buf; a < cpp; a++, s++) {
2824cf
 			    int c = xpmGetC(data);
2824cf
@@ -535,7 +554,11 @@ do \
2824cf
 		}
2824cf
 	    } else {
2824cf
 		for (y = 0; y < height; y++) {
2824cf
-		    xpmNextString(data);
2824cf
+		    ErrorStatus = xpmNextString(data);
2824cf
+		    if (ErrorStatus != XpmSuccess) {
2824cf
+			XpmFree(iptr2);
2824cf
+			return (ErrorStatus);
2824cf
+		    }
2824cf
 		    for (x = 0; x < width; x++, iptr++) {
2824cf
 			for (a = 0, s = buf; a < cpp; a++, s++) {
2824cf
 			    int c = xpmGetC(data);
2824cf
-- 
2824cf
2.39.0
2824cf