imageworsener is a utility for image scaling and processing.
There are two left shift visible with UbSan enabled.
# imagew $FILE /tmp/out -outfmt bmp src/imagew-util.c:415:68: runtime error: left shift of 255 by 24 places cannot be represented in type 'int' src/imagew-bmp.c:427:10: runtime error: left shift of 1 by 31 places cannot be represented in type 'int'
This bug was discovered by Agostino Sarubbo of Gentoo.
2017-04-13: bug discovered and reported to upstream
2017-04-22: upstream released a patch
2017-04-27: blog post about the issue
2017-04-29: CVE assigned
This bug was found with American Fuzzy Lop.