Fwd: [Png-mng-security] draft advisory for review

Hi Pierre and crew,

Has gd_png.c been adjusted for this yet? Since we only support a simple text
comment on an image (if memory serves), we should be able to take advantage
of the new API to limit the maximum size of text chunks and avoid the DOS
attack vulnerability.

---------- Forwarded message ----------
From: Glenn Randers-Pehrson <[email protected]>
Date: Fri, Feb 26, 2010 at 1:39 PM
Subject: [Png-mng-security] draft advisory for review
To: [email protected]


Please review this draft advisory and the document that it links to.

Glenn

[DRAFT] ADVISORY-1.4.1.txt for libpng 26 February 2010

Because of the efficient compression method used in Portable
Network Graphics (PNG) files, a small PNG file can expand
tremendously, acting as a "decompression bomb".  Malformed PNG
chunks can consume a large amount of CPU and wall-clock time and
large amounts of memory, up to all memory available on a system.

Eventually libpng would discover that the chunk was malformed or would
run out of memory, abandon the chunk and return the allocated memory,
so this is only a nasty Denial of Service (DoS) vulnerability that
probably cannot be used to compromise a system.

Libpng versions 1.4.1, 1.2.43, and 1.0.53 have been revised to use less
CPU time and memory. Libpng-1.4.1 also provides functions that applications
can use to further defend against such files.

For further details, see the libpng document "Defending Libpng
Applications Against Decompression Bombs", [temporarily] available at
<http://www.simplesystems.org/users/glennrp/decompression_bombs>

The PNG Development Group recommends that everyone upgrade to
libpng version 1.4.1, if at all possible.

Glenn Randers-Pehrson <glennrp at users.sourceforge.net>
_______________________________________________
Png-mng-security mailing list
[email protected]
http://www.simplesystems.org/mailman/listinfo/png-mng-security




-- 
Tom Boutell

http://www.tommybgoode.com/
http://boutell.livejournal.com/