Re: Sufficient patch for CVE-2006-0082

On Wed, 1 Mar 2006, Albert Chin wrote:

> Is the attached patch ok for CVE-2006-0082? It is taken from Gentoo:
>  http://www.gentoo.org/security/en/glsa/glsa-200602-13.xml

This patch is completely bogus.  It disables the intended function of 
the code.  The intended function of the code is to determine if any %d 
pattern exists in the filename string in order to support outputting a 
numbered sequence.  Unfortunately, snprintf does support some 
"dangerous" formatting sequences as well.  But the actual danger is 
not high as far as I can tell.

Bob

>
> --
> albert chin ([email protected])
>
> -- snip snip
> Index: magick/image.c
> ===================================================================
> RCS file: /GraphicsMagick/GraphicsMagick/magick/image.c,v
> retrieving revision 1.1237
> diff -u -3 -p -r1.1237 image.c
> --- magick/image.c	8 Jun 2005 00:23:40 -0000	1.1237
> +++ magick/image.c	1 Mar 2006 15:56:18 -0000
> @@ -4561,7 +4561,7 @@ MagickExport MagickPassFail SetImageInfo
>         Rectify multi-image file support.
>         FIXME: Does not work!
>       */
> -      FormatString(filename,image_info->filename,0);
> +      FormatString(filename,"%s",image_info->filename,0);
>       if ((LocaleCompare(filename,image_info->filename) != 0) &&
>           (strchr(filename,'%') == (char *) NULL))
>         image_info->adjoin=False;
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting language
> that extends applications into web and mobile media. Attend the live webcast
> and join the prime developer group breaking into this new coding territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> _______________________________________________
> Graphicsmagick-core mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/graphicsmagick-core
>

======================================
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642