Re: Triaging CVE-2025-27796 for Debian

--===============7136837962231744156==
Content-Type: multipart/alternative; boundary="----A4QA7EKHWOS4IEWQDHSYYK6322J01W"
Content-Transfer-Encoding: 7bit

------A4QA7EKHWOS4IEWQDHSYYK6322J01W
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
 charset=UTF-8

I will study the rest of your concerns later, but be aware that MagickFreeR=
esourceLimitedMemory() is a macro and it sets the named variable to null (j=
ust as MagickFreeMemory() does)=2E

The original author of this code has le=
ft the project=2E

Bob

On Mar 31, 2025, 9:53=E2=80=AFAM, at 9:53=E2=80=AFA=
M, Carlos Henrique Lima Melara <charlesmelara@riseup=2Enet> wrote:
>Hi,
>
>=
I'm triaging graphicsmagick's CVE-2025-27796 and would like to request
>a
>=
second opinion from the people who actually know the code=2E This CVE's
>de=
scription is "ReadWPGImage in WPG in GraphicsMagick before 1=2E3=2E46
>mish=
andles palette buffer allocation, resulting in out-of-bounds access
>to hea=
p memory in ReadBlob"=2E The CVE links to bug 750 [1] on
>sourceforge
>but =
it's not public at the moment=2E
>
>My analysis indicates the issue happens=
 on the following snippet of
>code
>[2] from ReadWPGImage()=2E
>
>[=2E=2E=
=2E]
>if(pPalette!=3DNULL &&
>PaletteAllocBytes <
>4*(WPG_Palette=2EStartIn=
dex+WPG_Palette=2ENumOfEntries))
>{
>  MagickFreeResourceLimitedMemory(pPal=
ette);
>  PaletteAllocBytes =3D 0;
>}
>if(pPalette=3D=3DNULL)
>{
>  Palette=
Items =3D WPG_Palette=2ENumOfEntries;
>PaletteAllocBytes =3D
>4*(WPG_Palett=
e=2EStartIndex+WPG_Palette=2ENumOfEntries);
>  if(PaletteAllocBytes < 4*256=
) PaletteAllocBytes =3D 4*256;
>pPalette =3D MagickAllocateResourceLimitedM=
emory(unsigned char
>*,(size_t)PaletteAllocBytes);
>  if(pPalette=3D=3DNULL=
)
> ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
=
>  for(i=3D0; i<=3D255; i++)
>  {
>    pPalette[4*i] =3D WPG1_Palette[i]=2E=
Red;
>    pPalette[4*i+1] =3D WPG1_Palette[i]=2EGreen;
>    pPalette[4*i+2]=
 =3D WPG1_Palette[i]=2EBlue;
>    pPalette[4*i+3] =3D OpaqueOpacity;
>  }
>=
}
>if(ReadBlob(image,(size_t)
>PaletteItems*4,pPalette+((size_t)4*WPG_Palet=
te=2EStartIndex)) !=3D (size_t)
>PaletteItems*4)
>{
>  MagickFreeResourceLi=
mitedMemory(pPalette);
> ThrowReaderException(ResourceLimitError,MemoryAllo=
cationFailed,image);
>}
>break;
>[=2E=2E=2E]
>
>Looking at the code before =
the fix we see that when pPalette is already
>allocated but is smaller than=

>4*(WPG_Palette=2EStartIndex+WPG_Palette=2ENumOfEntries), it
>MagickFreeRe=
sourceLimitedMemory (which doesn't set pPallete to NULL!)
>which sets Palet=
teAllocBytes to 0=2E Now the second if
>(if(pPalette=3D=3DNULL))
>is skippe=
d because pPallete isn't NULL and it proceeds to
>ReadBlob(image,(size_t) P=
aletteItems*4,
>pPalette+((size_t)4*WPG_Palette=2EStartIndex)=2E The third =
argument to that
>function "Specifies an area to place the information requ=
ested from the
>file", but it's a pointer to a 0-sized buffer because of
>M=
agickFreeResourceLimitedMemory(pPalette) and hence the "out-of-bounds
>acce=
ss to heap memory in ReadBlob"=2E
>
>It was introduced in a2be6a9 [3] (only=
 present in 1=2E3=2E43 and
>afterwards)=2E
>Before that, it used already al=
located buffers in the image object so
>the vulnerability wouldn't be prese=
nt=2E
>
>Can you confirm the analysis is correct and the vulnerability is o=
nly
>present after a2be6a9 [3] (v1=2E3=2E43 and afterwards)?
>
>Cheers,
>Ch=
arles
>
>[1] https://sourceforge=2Enet/p/graphicsmagick/bugs/750/
>[2]
>htt=
ps://foss=2Eheptapod=2Enet/graphicsmagick/graphicsmagick/-/blob/3b7fcd60f49=
8cfadda813e0e76d159c5d08f190a/coders/wpg=2Ec#L1707
>[3]
>https://foss=2Ehep=
tapod=2Enet/graphicsmagick/graphicsmagick/-/commit/a2be6a996a8c190bc75db02a=
74a93dcab813e9c4
>
>
>_______________________________________________
>Grap=
hicsmagick-bugs mailing list
>Graphicsmagick-bugs@lists=2Esourceforge=2Enet=

>https://lists=2Esourceforge=2Enet/lists/listinfo/graphicsmagick-bugs

------A4QA7EKHWOS4IEWQDHSYYK6322J01W
Content-Type: text/html;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head></head><body style=3D"zoom: 0%;"><div dir=3D"auto">I will study=
 the rest of your concerns later, but be aware that MagickFreeResourceLimit=
edMemory() is a macro and it sets the named variable to null (just as Magic=
kFreeMemory() does)=2E<br><br></div>
<div dir=3D"auto">The original author =
of this code has left the project=2E<br><br></div>
<div dir=3D"auto">Bob</d=
iv>
<div class=3D"gmail_quote" >On Mar 31, 2025, at 9:53=E2=80=AFAM, Carlos=
 Henrique Lima Melara &lt;<a href=3D"mailto:charlesmelara@riseup=2Enet" tar=
get=3D"_blank">charlesmelara@riseup=2Enet</a>&gt; wrote:<blockquote class=
=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; border-left: 1px sol=
id rgb(204, 204, 204); padding-left: 1ex;">
<pre class=3D"blue">Hi,<br><br>=
I'm triaging graphicsmagick's CVE-2025-27796 and would like to request a<br=
>second opinion from the people who actually know the code=2E This CVE's<br=
>description is "ReadWPGImage in WPG in GraphicsMagick before 1=2E3=2E46<br=
>mishandles palette buffer allocation, resulting in out-of-bounds access<br=
>to heap memory in ReadBlob"=2E The CVE links to bug 750 [1] on sourceforge=
<br>but it's not public at the moment=2E<br><br>My analysis indicates the i=
ssue happens on the following snippet of code<br>[2] from ReadWPGImage()=2E=
<br><br>[=2E=2E=2E]<br>if(pPalette!=3DNULL &amp;&amp;<br>   PaletteAllocByt=
es &lt; 4*(WPG_Palette=2EStartIndex+WPG_Palette=2ENumOfEntries))<br>{<br>  =
MagickFreeResourceLimitedMemory(pPalette);<br>  PaletteAllocBytes =3D 0;<br=
>}<br>if(pPalette=3D=3DNULL)<br>{<br>  PaletteItems =3D WPG_Palette=2ENumOf=
Entries;<br>  PaletteAllocBytes =3D 4*(WPG_Palette=2EStartIndex+WPG_Palette=
=2ENumOfEntries);<br>  if(PaletteAllocBytes &lt; 4*256) PaletteAllocBytes =
=3D 4*256;<br>  pPalette =3D MagickAllocateResourceLimitedMemory(unsigned c=
har *,(size_t)PaletteAllocBytes);<br>  if(pPalette=3D=3DNULL)<br>      Thro=
wReaderException(ResourceLimitError,MemoryAllocationFailed,image);<br>  for=
(i=3D0; i&lt;=3D255; i++)<br>  {<br>    pPalette[4*i] =3D WPG1_Palette[i]=
=2ERed;<br>    pPalette[4*i+1] =3D WPG1_Palette[i]=2EGreen;<br>    pPalette=
[4*i+2] =3D WPG1_Palette[i]=2EBlue;<br>    pPalette[4*i+3] =3D OpaqueOpacit=
y;<br>  }<br>}<br>if(ReadBlob(image,(size_t) PaletteItems*4,pPalette+((size=
_t)4*WPG_Palette=2EStartIndex)) !=3D (size_t) PaletteItems*4)<br>{<br>  Mag=
ickFreeResourceLimitedMemory(pPalette);<br>  ThrowReaderException(ResourceL=
imitError,MemoryAllocationFailed,image);<br>}<br>break;<br>[=2E=2E=2E]<br><=
br>Looking at the code before the fix we see that when pPalette is already<=
br>allocated but is smaller than<br>4*(WPG_Palette=2EStartIndex+WPG_Palette=
=2ENumOfEntries), it<br>MagickFreeResourceLimitedMemory (which doesn't set =
pPallete to NULL!)<br>which sets PaletteAllocBytes to 0=2E Now the second i=
f (if(pPalette=3D=3DNULL))<br>is skipped because pPallete isn't NULL and it=
 proceeds to<br>ReadBlob(image,(size_t) PaletteItems*4,<br>pPalette+((size_=
t)4*WPG_Palette=2EStartIndex)=2E The third argument to that<br>function "Sp=
ecifies an area to place the information requested from the<br>file", but i=
t's a pointer to a 0-sized buffer because of<br>MagickFreeResourceLimitedMe=
mory(pPalette) and hence the "out-of-bounds<br>access to heap memory in Rea=
dBlob"=2E<br><br>It was introduced in a2be6a9 [3] (only present in 1=2E3=2E=
43 and afterwards)=2E<br>Before that, it used already allocated buffers in =
the image object so<br>the vulnerability wouldn't be present=2E<br><br>Can =
you confirm the analysis is correct and the vulnerability is only<br>presen=
t after a2be6a9 [3] (v1=2E3=2E43 and afterwards)?<br><br>Cheers,<br>Charles=
<br><br>[1] <a href=3D"https://sourceforge=2Enet/p/graphicsmagick/bugs/750"=
>https://sourceforge=2Enet/p/graphicsmagick/bugs/750</a>/<br>[2] <a href=3D=
"https://foss=2Eheptapod=2Enet/graphicsmagick/graphicsmagick/-/blob/3b7fcd6=
0f498cfadda813e0e76d159c5d08f190a/coders/wpg=2Ec#L1707">https://foss=2Ehept=
apod=2Enet/graphicsmagick/graphicsmagick/-/blob/3b7fcd60f498cfadda813e0e76d=
159c5d08f190a/coders/wpg=2Ec#L1707</a><br>[3] <a href=3D"https://foss=2Ehep=
tapod=2Enet/graphicsmagick/graphicsmagick/-/commit/a2be6a996a8c190bc75db02a=
74a93dcab813e9c4">https://foss=2Eheptapod=2Enet/graphicsmagick/graphicsmagi=
ck/-/commit/a2be6a996a8c190bc75db02a74a93dcab813e9c4</a><br><br><br><hr><br=
>Graphicsmagick-bugs mailing list<br>Graphicsmagick-bugs@lists=2Esourceforg=
e=2Enet<br><a href=3D"https://lists=2Esourceforge=2Enet/lists/listinfo/grap=
hicsmagick-bugs">https://lists=2Esourceforge=2Enet/lists/listinfo/graphicsm=
agick-bugs</a><br></pre></blockquote></div></body></html>
------A4QA7EKHWOS4IEWQDHSYYK6322J01W--



--===============7136837962231744156==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7136837962231744156==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Graphicsmagick-bugs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/graphicsmagick-bugs

--===============7136837962231744156==--