[Debian-astro-maintainers] Bug#984761: dcraw: buffer-overflow caused by integer-overflow in foveon_load_camf()

[Wooseok Kang]

Package: dcraw
Version: 9.28-2
Severity: normal
X-Debbugs-Cc: kangwoosuk1 at gmail.com

Dear Maintainer,

There is an integer overflow vulnerability in dcraw.
When the victim runs dcraw with a maliciously crafted X3F input image,
arbitrary code may be executed in the victim's system.

The vulnerability resides in foveon_load_camf() function in dcraw.c file.
The program reads data from the input image using get4().

type = get4();  get4();  get4();
wide = get4();
high = get4();

Since there is no sanitization for these variables, we can set their values freely.
Let type=4, and wide and high are enough large values which can make overflow.
Then, it will lead to small memory allocation at the below code.

} else if (type == 4) {
    free (meta_data);
    meta_length = wide*high*3/2;
    meta_data = (char *) malloc (meta_length);

Therefore, when we read data to this allocated buffer,
it causes the buffer overrun which may lead to arbitrary code execution or program crash.

I attach the maliciously crafted X3F file which crashes dcraw like below.
> dcraw dcraw-poc.X3F
dcraw-poc.X3F: Corrupt data near 0x651
[1]    1251 segmentation fault  dcraw dcraw-poc.X3F

Thank you.

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 5.4.72-microsoft-standard-WSL2 (SMP w/16 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages dcraw depends on:
ii  libc6            2.31-9
ii  libjpeg62-turbo  1:2.0.6-2
ii  liblcms2-2       2.12~rc1-2

dcraw recommends no packages.

Versions of packages dcraw suggests:
pn  gphoto2  <none>
pn  netpbm   <none>

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dcraw-poc.X3F
Type: image/x-x3f
Size: 15908088 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/debian-astro-maintainers/attachments/20210308/6a42c8eb/attachment-0001.bin>