{"id":947,"date":"2016-11-22T18:49:11","date_gmt":"2016-11-22T16:49:11","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=947"},"modified":"2016-11-22T18:49:11","modified_gmt":"2016-11-22T16:49:11","slug":"metapixel-multiple-assertion-failures","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/11\/22\/metapixel-multiple-assertion-failures\/","title":{"rendered":"metapixel: multiple assertion failures"},"content":{"rendered":"

Description<\/strong>:
\nmetapixel<\/a> is a program for generating photomosaics.<\/p>\n

A fuzzing on metapixel-imagesize revealed multiple assertion failures. The latest upstream release was about ten years ago, so I didn’t made any report. The bugs do not reside in any shared object which aren’t provided by the package. If you have a web application which relies on the metapixel-imagesize binary, then you are affected. Since the crashes reside in the command line tool, they may don’t warrant a CVE at all, but some distros and packagers would have the bugs fixed in their repository, so I’m sharing them.<\/p>\n

Affected version<\/strong>:
\n1.0.2
\nOutput\/failure<\/strong>:
\nmetapixel-imagesize: rwgif.c:59: void *open_gif_file(const char *, int *, int *): Assertion `data->file !=0′ failed.
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00059-metapixel-assert-open_gif_file-1<\/a><\/p>\n

##########################################<\/p>\n

Affected version<\/strong>:
\n1.0.2
\nOutput\/failure<\/strong>:
\nmetapixel-imagesize: rwgif.c:63: void *open_gif_file(const char *, int *, int *): Assertion `DGifGetRecordType(data->file, &record_type) != 0′ failed.
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00060-metapixel-assert-open_gif_file-2<\/a><\/p>\n

##########################################<\/p>\n

Affected version<\/strong>:
\n1.0.2
\nOutput\/failure<\/strong>:
\nmetapixel-imagesize: rwgif.c:68: void *open_gif_file(const char *, int *, int *): Assertion `DGifGetImageDesc(data->file) != 0′ failed.
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00061-metapixel-assert-open_gif_file-3<\/a><\/p>\n

##########################################<\/p>\n

Affected version<\/strong>:
\n1.0.2
\nOutput\/failure<\/strong>:
\nmetapixel-imagesize: rwgif.c:102: void *open_gif_file(const char *, int *, int *): Assertion `DGifGetExtension(data->file, &ext_code, &ext) != 0′ failed.
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00062-metapixel-assert-open_gif_file-4<\/a><\/p>\n

##########################################<\/p>\n

Affected version<\/strong>:
\n1.0.2
\nOutput\/failure<\/strong>:
\nmetapixel-imagesize: rwgif.c:106: void *open_gif_file(const char *, int *, int *): Assertion `DGifGetExtensionNext(data->file, &ext) != 0′ failed.
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00063-metapixel-assert-open_gif_file-5<\/a><\/p>\n

Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n

Timeline:<\/strong>
\n2016-11-22: bugs discovered
\n2016-11-22: blog post about the issues<\/p>\n

Note:<\/strong>
\nThese bugs were found with American Fuzzy Lop<\/a>.<\/p>\n

Permalink:<\/strong><\/p>\n

metapixel: multiple assertion failures<\/a><\/p><\/blockquote>\n