The DjVuLibre document compression library (tested version 3.5.29) is vulnerable to an integer overflow caused by a left shift of a negative signed integer in the IW44EncodeCodec.cpp component. When processing crafted PPM input passed through the c44 utility, negative pixel values are left-shifted in functions such as filter_fh, filter_fv, and IW44Image::Map::Encode::create. This results in undefined behavior and corrupted intermediate state during encoding. An attacker can trigger the condition by supplying specially crafted image data, potentially leading to memory corruption, application crash*, *or information disclosure depending on compiler optimizations and runtime environment.
*Impact:* - Crash (DoS) confirmed with UBSan/ASan. - Possible memory corruption due to undefined behavior on signed shifts *Proof of Concept:* convert -size 500x500 gradient: bad.ppm ASAN_OPTIONS=detect_leaks=0,abort_on_error=1 \ UBSAN_OPTIONS=print_stacktrace=1 \ ./tools/c44 bad.ppm out.djvu *Sanitizer Output:* IW44EncodeCodec.cpp:936:30: runtime error: left shift of negative value -128 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior IW44EncodeCodec.cpp:936:30 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
