From c357fb70b5de63862a9737c645a83e2d980c2e75 Mon Sep 17 00:00:00 2001 From: Glenn Randers-Pehrson Date: Wed, 19 Aug 2015 12:52:39 -0500 Subject: [PATCH] [lbipng15] Fixed the recently reported 1's complement security issue by replacing the value that is illegal in the PNG spec, in both signed and unsigned values, with 0. Illegal unsigned values (anything greater than or equal to 0x80000000) can still pass through, but since these are not illegal in ANSI-C (unlike 0x80000000 in the signed case) the checking that occurs later can catch them (John Bowler). Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert Seacord). --- ANNOUNCE | 10 ++++++++-- CHANGES | 8 +++++++- libpng-manual.txt | 6 +++--- libpng.3 | 14 +++++++------- png.c | 4 ++-- png.h | 12 ++++++------ pngrutil.c | 8 +++++++- 7 files changed, 40 insertions(+), 22 deletions(-) diff --git a/ANNOUNCE b/ANNOUNCE index 73271a6ea..018fc668a 100644 --- a/ANNOUNCE +++ b/ANNOUNCE @@ -1,5 +1,5 @@ -Libpng 1.5.24beta01 - August 18, 2015 +Libpng 1.5.24beta01 - August 19, 2015 This is not intended to be a public release. It will be replaced within a few weeks by a public version or by another test version. @@ -27,7 +27,7 @@ Other information: Changes since the last public release (1.5.23): -Version 1.5.24beta01 [August 18, 2015] +Version 1.5.24beta01 [August 19, 2015] Avoid potentially dereferencing NULL info_ptr in png_info_init_3(). Eliminated unused PNG_COST_SHIFT, PNG_WEIGHT_SHIFT, PNG_COST_FACTOR, and PNG_WEIGHT_FACTOR macros. @@ -36,6 +36,12 @@ Version 1.5.24beta01 [August 18, 2015] Fixed some bad links in the man page. Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert Seacord). + Fixed the recently reported 1's complement security issue by replacing + the value that is illegal in the PNG spec, in both signed and unsigned + values, with 0. Illegal unsigned values (anything greater than or equal + to 0x80000000) can still pass through, but since these are not illegal + in ANSI-C (unlike 0x80000000 in the signed case) the checking that + occurs later can catch them (John Bowler). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/CHANGES b/CHANGES index 64c0eb9cc..c597e8754 100644 --- a/CHANGES +++ b/CHANGES @@ -4373,7 +4373,7 @@ Version 1.5.23rc03 [July 15, 2015] Version 1.5.23 [July 23, 2015] No changes. -Version 1.5.24beta01 [August 18, 2015] +Version 1.5.24beta01 [August 19, 2015] Avoid potentially dereferencing NULL info_ptr in png_info_init_3(). Eliminated unused PNG_COST_SHIFT, PNG_WEIGHT_SHIFT, PNG_COST_FACTOR, and PNG_WEIGHT_FACTOR macros. @@ -4382,6 +4382,12 @@ Version 1.5.24beta01 [August 18, 2015] Fixed some bad links in the man page. Safely convert num_bytes to a png_byte in png_set_sig_bytes() (Robert Seacord). + Fixed the recently reported 1's complement security issue by replacing + the value that is illegal in the PNG spec, in both signed and unsigned + values, with 0. Illegal unsigned values (anything greater than or equal + to 0x80000000) can still pass through, but since these are not illegal + in ANSI-C (unlike 0x80000000 in the signed case) the checking that + occurs later can catch them (John Bowler). Send comments/corrections/commendations to png-mng-implement at lists.sf.net (subscription required; visit diff --git a/libpng-manual.txt b/libpng-manual.txt index 700ee2ee1..9edc4f2f9 100644 --- a/libpng-manual.txt +++ b/libpng-manual.txt @@ -1,6 +1,6 @@ Libpng-manual.txt - A description on how to use and modify libpng - libpng version 1.5.24beta01 - August 18, 2015 + libpng version 1.5.24beta01 - August 19, 2015 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2014 Glenn Randers-Pehrson @@ -11,7 +11,7 @@ Libpng-manual.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.5.24beta01 - August 18, 2015 + libpng versions 0.97, January 1998, through 1.5.24beta01 - August 19, 2015 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2014 Glenn Randers-Pehrson @@ -4501,7 +4501,7 @@ Other rules can be inferred by inspecting the libpng source. XIV. Y2K Compliance in libpng -August 18, 2015 +August 19, 2015 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. diff --git a/libpng.3 b/libpng.3 index 1c3f6ae4e..cf2485d7a 100644 --- a/libpng.3 +++ b/libpng.3 @@ -1,4 +1,4 @@ -.TH LIBPNG 3 "August 18, 2015" +.TH LIBPNG 3 "August 19, 2015" .SH NAME libpng \- Portable Network Graphics (PNG) Reference Library 1.5.24beta01 .SH SYNOPSIS @@ -496,7 +496,7 @@ Following is a copy of the libpng-manual.txt file that accompanies libpng. .SH LIBPNG.TXT Libpng-manual.txt - A description on how to use and modify libpng - libpng version 1.5.24beta01 - August 18, 2015 + libpng version 1.5.24beta01 - August 19, 2015 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2014 Glenn Randers-Pehrson @@ -507,7 +507,7 @@ Libpng-manual.txt - A description on how to use and modify libpng Based on: - libpng versions 0.97, January 1998, through 1.5.24beta01 - August 18, 2015 + libpng versions 0.97, January 1998, through 1.5.24beta01 - August 19, 2015 Updated and distributed by Glenn Randers-Pehrson Copyright (c) 1998-2014 Glenn Randers-Pehrson @@ -4997,7 +4997,7 @@ Other rules can be inferred by inspecting the libpng source. .SH XIV. Y2K Compliance in libpng -August 18, 2015 +August 19, 2015 Since the PNG Development group is an ad-hoc body, we can't make an official declaration. @@ -5310,7 +5310,7 @@ possible without all of you. Thanks to Frank J. T. Wojcik for helping with the documentation. -Libpng version 1.5.24beta01 - August 18, 2015: +Libpng version 1.5.24beta01 - August 19, 2015: Initially created in 1995 by Guy Eric Schalnat, then of Group 42, Inc. Currently maintained by Glenn Randers-Pehrson (glennrp at users.sourceforge.net). @@ -5333,7 +5333,7 @@ this sentence. This code is released under the libpng license. -libpng versions 1.0.7, July 1, 2000, through 1.5.24beta01, August 18, 2015, are +libpng versions 1.0.7, July 1, 2000, through 1.5.24beta01, August 19, 2015, are Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are distributed according to the same disclaimer and license as libpng-1.0.6 with the following individuals added to the list of Contributing Authors: @@ -5426,7 +5426,7 @@ the additional disclaimers inserted at version 1.0.7. Glenn Randers-Pehrson glennrp at users.sourceforge.net -August 18, 2015 +August 19, 2015 .\" end of man page diff --git a/png.c b/png.c index 7c3b90bb4..635f6368a 100644 --- a/png.c +++ b/png.c @@ -655,13 +655,13 @@ png_get_copyright(png_const_structp png_ptr) #else # ifdef __STDC__ return PNG_STRING_NEWLINE \ - "libpng version 1.5.24beta01 - August 18, 2015" PNG_STRING_NEWLINE \ + "libpng version 1.5.24beta01 - August 19, 2015" PNG_STRING_NEWLINE \ "Copyright (c) 1998-2015 Glenn Randers-Pehrson" PNG_STRING_NEWLINE \ "Copyright (c) 1996-1997 Andreas Dilger" PNG_STRING_NEWLINE \ "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc." \ PNG_STRING_NEWLINE; # else - return "libpng version 1.5.24beta01 - August 18, 2015\ + return "libpng version 1.5.24beta01 - August 19, 2015\ Copyright (c) 1998-2015 Glenn Randers-Pehrson\ Copyright (c) 1996-1997 Andreas Dilger\ Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."; diff --git a/png.h b/png.h index 94bb01226..4e7519a6f 100644 --- a/png.h +++ b/png.h @@ -1,7 +1,7 @@ /* png.h - header file for PNG reference library * - * libpng version 1.5.24beta01, July 24, 2015 + * libpng version 1.5.24beta01, August 19, 2015 * * Copyright (c) 1998-2015 Glenn Randers-Pehrson * (Version 0.96 Copyright (c) 1996, 1997 Andreas Dilger) @@ -12,7 +12,7 @@ * Authors and maintainers: * libpng versions 0.71, May 1995, through 0.88, January 1996: Guy Schalnat * libpng versions 0.89c, June 1996, through 0.96, May 1997: Andreas Dilger - * libpng versions 0.97, January 1998, through 1.5.24beta01, July 24, 2015: Glenn + * libpng versions 0.97, January 1998, through 1.5.24beta01, August 19, 2015: Glenn * See also "Contributing Authors", below. * * Note about libpng version numbers: @@ -244,7 +244,7 @@ * * This code is released under the libpng license. * - * libpng versions 1.0.7, July 1, 2000, through 1.5.24beta01, July 24, 2015, are + * libpng versions 1.0.7, July 1, 2000, through 1.5.24beta01, August 19, 2015, are * Copyright (c) 2000-2002, 2004, 2006-2015 Glenn Randers-Pehrson, and are * distributed according to the same disclaimer and license as libpng-1.0.6 * with the following individuals added to the list of Contributing Authors: @@ -352,7 +352,7 @@ * Y2K compliance in libpng: * ========================= * - * July 24, 2015 + * August 19, 2015 * * Since the PNG Development group is an ad-hoc body, we can't make * an official declaration. @@ -421,7 +421,7 @@ /* Version information for png.h - this should match the version in png.c */ #define PNG_LIBPNG_VER_STRING "1.5.24beta01" #define PNG_HEADER_VERSION_STRING \ - " libpng version 1.5.24beta01 - July 24, 2015\n" + " libpng version 1.5.24beta01 - August 19, 2015\n" #define PNG_LIBPNG_VER_SONUM 15 #define PNG_LIBPNG_VER_DLLNUM 15 @@ -2652,7 +2652,7 @@ PNG_EXPORT(207, void, png_save_uint_16, (png_bytep buf, unsigned int i)); # define png_get_int_32(buf) \ ((png_int_32)((*(buf) & 0x80) \ - ? -((png_int_32)((png_get_uint_32(buf) ^ 0xffffffffL) + 1)) \ + ? -((png_int_32)(((png_get_uint_32(buf)^0xffffffffU)+1U)&0x7fffffffU)) \ : (png_int_32)png_get_uint_32(buf))) #endif diff --git a/pngrutil.c b/pngrutil.c index dccca52c4..ae1727a52 100644 --- a/pngrutil.c +++ b/pngrutil.c @@ -89,7 +89,13 @@ png_get_int_32)(png_const_bytep buf) return uval; uval = (uval ^ 0xffffffff) + 1; /* 2's complement: -x = ~x+1 */ - return -(png_int_32)uval; + if ((uval & 0x80000000) == 0) /* no overflow */ + return -(png_int_32)uval; + /* The following has to be safe; this function only gets called on PNG data + * and if we get here that data is invalid. 0 is the most safe value and + * if not then an attacker would surely just generate a PNG with 0 instead. + */ + return 0; } /* Grab an unsigned 16-bit integer from a buffer in big-endian format. */