Bug 274822 - graphics/optipng: Update to 0.7.7_1 and fix CVE-2023-43907
Summary: graphics/optipng: Update to 0.7.7_1 and fix CVE-2023-43907
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Robert Clausecker
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-30 22:57 UTC by Thomas Hurst
Modified: 2023-11-05 15:01 UTC (History)
2 users (show)

See Also:
fuz: merge-quarterly+


Attachments
Patch for graphics/optipng (2.98 KB, application/mbox)
2023-10-30 22:57 UTC, Thomas Hurst
tom: maintainer-approval+
Details
Updated patch for graphics/optipng (2.98 KB, patch)
2023-10-30 23:28 UTC, Thomas Hurst
tom: maintainer-approval+
Details | Diff
Updated, updated patch for graphics/optipng (3.00 KB, patch)
2023-10-30 23:59 UTC, Thomas Hurst
tom: maintainer-approval+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Hurst 2023-10-30 22:57:04 UTC
Created attachment 246007 [details]
Patch for graphics/optipng

Patch in a bounds check in gifread.c, verified as preventing the out of bounds 1 byte read demonstrated by https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md

The optional configuration for using bundled libraries has been removed due to their age (with several CVEs noted in libpng since) and lack of any demonstrated benefit.
Comment 1 Thomas Hurst 2023-10-30 23:28:43 UTC
Created attachment 246008 [details]
Updated patch for graphics/optipng

Some irony in being off by one in the other direction.
Comment 2 Thomas Hurst 2023-10-30 23:59:51 UTC
Created attachment 246009 [details]
Updated, updated patch for graphics/optipng

No point guarding the loop if code_size = 0, since it'll never execute.
Comment 3 Robert Clausecker freebsd_committer freebsd_triage 2023-11-02 03:05:34 UTC
Will MFH and add VuXML entry.
Comment 4 Thomas Hurst 2023-11-02 09:42:05 UTC
Thanks!

Upstream suggests we may see a 0.7.8 in the next day or so if you wanted to save some churn.
Comment 5 Robert Clausecker freebsd_committer freebsd_triage 2023-11-02 15:07:25 UTC
Just replace the patch when it gets to that and I'll try to get it in.
Comment 6 commit-hook freebsd_committer freebsd_triage 2023-11-03 21:19:12 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=058d72efccdaaff3cca0d5780fb3de61d64a5321

commit 058d72efccdaaff3cca0d5780fb3de61d64a5321
Author:     Robert Clausecker <fuz@FreeBSD.org>
AuthorDate: 2023-11-02 03:04:33 +0000
Commit:     Robert Clausecker <fuz@FreeBSD.org>
CommitDate: 2023-11-03 21:16:08 +0000

    security/vuxml: document optipng vulnerability

    PR:             274822
    Reported by:    Thomas Hurst <tom@hur.st>

 security/vuxml/vuln/2023.xml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
Comment 7 commit-hook freebsd_committer freebsd_triage 2023-11-03 21:19:18 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=0a1052798c8e4879ca869b9032830a4ca00b1c02

commit 0a1052798c8e4879ca869b9032830a4ca00b1c02
Author:     Thomas Hurst <tom@hur.st>
AuthorDate: 2023-10-30 22:45:22 +0000
Commit:     Robert Clausecker <fuz@FreeBSD.org>
CommitDate: 2023-11-03 21:16:19 +0000

    graphics/optipng: Add fix for CVE-2023-43907

     - Add a bounds check to prevent out-of-bounds read of buffer on
       specially-formed GIF files.
     - Remove BUNDLED_LIBPNG and BUNDLED_ZLIB, as the supplied versions are
       well out of date and offer no noted advantages.

    PR:             274822
    MFH:            2023Q4
    Security:       fe7ac70a-792b-11ee-bf9a-a04a5edf46d9

 graphics/optipng/Makefile                          | 28 ++++++++++------------
 .../files/patch-src_gifread_gifread.c (new)        | 14 +++++++++++
 2 files changed, 26 insertions(+), 16 deletions(-)
Comment 8 commit-hook freebsd_committer freebsd_triage 2023-11-03 21:25:35 UTC
A commit in branch 2023Q4 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=0ce6caa1ea714ad0ff196f909713648193d8d3ba

commit 0ce6caa1ea714ad0ff196f909713648193d8d3ba
Author:     Thomas Hurst <tom@hur.st>
AuthorDate: 2023-10-30 22:45:22 +0000
Commit:     Robert Clausecker <fuz@FreeBSD.org>
CommitDate: 2023-11-03 21:20:01 +0000

    graphics/optipng: Add fix for CVE-2023-43907

     - Add a bounds check to prevent out-of-bounds read of buffer on
       specially-formed GIF files.
     - Remove BUNDLED_LIBPNG and BUNDLED_ZLIB, as the supplied versions are
       well out of date and offer no noted advantages.

    PR:             274822
    MFH:            2023Q4
    Security:       fe7ac70a-792b-11ee-bf9a-a04a5edf46d9
    (cherry picked from commit 0a1052798c8e4879ca869b9032830a4ca00b1c02)

 graphics/optipng/Makefile                          | 28 ++++++++++------------
 .../files/patch-src_gifread_gifread.c (new)        | 14 +++++++++++
 2 files changed, 26 insertions(+), 16 deletions(-)
Comment 9 Robert Clausecker freebsd_committer freebsd_triage 2023-11-03 21:32:06 UTC
Committed and MFH'ed.
Note that diizzy's suggestion to deprecate the port is just that: a suggestion.  You are not obliged to follow it.  Personally I believe this is an important port that should not be deprecated.
Comment 10 Daniel Engberg freebsd_committer freebsd_triage 2023-11-05 15:01:31 UTC
Please update this to 0.7.8, gmake dependency can be dropped and you can also switch to DISTVERSION instead fo PORTVERSION.

Deprecation suggestion was based upon known security issue that hadn't been fixed for over month and years or little to no activity at all.