Skip to content
Snippets Groups Projects
Commit f80fa6ae authored by Alan Coopersmith's avatar Alan Coopersmith
Browse files

Fix CVE-2022-44617: Runaway loop with width of 0 and enormous height


When reading XPM images from a file with libXpm 3.5.14 or older, if a
image has a width of 0 and a very large height, the ParsePixels() function
will loop over the entire height calling getc() and ungetc() repeatedly,
or in some circumstances, may loop seemingly forever, which may cause a
denial of service to the calling program when given a small crafted XPM
file to parse.

Closes: #2

Reported-by: default avatarMartin Ettl <ettl.martin78@googlemail.com>
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
parent f7fbbb92
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment