Emilio Pozuelo Monfort pushed to branch upstream-unstable at X Strike Force / lib / libxpm
Commits: 6e42eb9e by Olivier Fourdan at 2026-09-24T00:42:28+00:00 ParsePixels: reject zero-dimension XPM images - - - - - 62e70090 by Olivier Fourdan at 2026-09-30T10:26:24+02:00 Revert "ParsePixels: reject zero-dimension XPM images" The commit message was lost when merging !32. Reapplying the same fix with the full commit next. This reverts commit 6e42eb9e105ae17318f3ba5656d94cd3f80eeaa3. Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/33> - - - - - 58eb875b by Olivier Fourdan at 2026-09-30T10:26:57+02:00 ParsePixels: reject zero-dimension XPM images The existing dimension checks in ParsePixels() reject mismatched zeros (width==0 with height!=0, or vice versa) but accept the case where both width and height are zero. As a result, a 0x0 XPM can therefore pass parsing and reach the function WritePixels(), which computes the row loop bound as "h = height - 1" using unsigned arithmetic. With a zero height this underflows to UINT_MAX, causing a near-infinite write loop. To avoid that issue, simply reject any image with a zero width or height dimension as an invalid XPM file. Found by AISLE in partnership with Red Hat AISLE-Report-PSIRTSUPT-14424 CVE-2026-94287 Reported-by: Aisle Research Assisted-by: AI Signed-off-by: Olivier Fourdan <[email protected]> Fixes: 6e42eb9e1 - ParsePixels: reject zero-dimension XPM images Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/33> - - - - - 34f15baa by Alan Coopersmith at 2026-10-16T12:55:31-07:00 libXpm 3.5.20 Signed-off-by: Alan Coopersmith <[email protected]> - - - - - 2 changed files: - configure.ac - src/parse.c Changes: ===================================== configure.ac ===================================== @@ -1,7 +1,7 @@ # Initialize Autoconf AC_PREREQ([2.60]) -AC_INIT([libXpm], [3.5.19], +AC_INIT([libXpm], [3.5.20], [https://gitlab.freedesktop.org/xorg/lib/libxpm/-/issues/], [libXpm]) AC_CONFIG_SRCDIR([Makefile.am]) AC_CONFIG_HEADERS([config.h]) ===================================== src/parse.c ===================================== @@ -414,10 +414,7 @@ ParsePixels( unsigned int a, x, y; int ErrorStatus; - if ((width == 0) && (height != 0)) - return (XpmFileInvalid); - - if ((height == 0) && (width != 0)) + if (width == 0 || height == 0) return (XpmFileInvalid); if ((height > 0 && width >= UINT_MAX / height) || View it on GitLab: https://salsa.debian.org/xorg-team/lib/libxpm/-/compare/9a05472d7ebcdf6deaa970515f3ddba2b0fc265e...34f15baa50a14e1bb8e33ed42d8f252a06446fd8 -- View it on GitLab: https://salsa.debian.org/xorg-team/lib/libxpm/-/compare/9a05472d7ebcdf6deaa970515f3ddba2b0fc265e...34f15baa50a14e1bb8e33ed42d8f252a06446fd8 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
