| शीर्षक | SerenityOS SerenityOS LibGfx >= d76ad23 Integer Overflow |
|---|
| विवरण | SerenityOS is a graphical Unix-like operating system that includes the LibGfx image decoding library.
This code is vulnerable to CWE-190: Integer Overflow or Wraparound due to improper validation of the BMP DIB header height value. The decode_bmp_pixel_data() function processes the signed 32-bit height field from an attacker-controlled BMP file and applies abs() to the value without checking for "INT_MIN"(-2147483648). Because the absolute value of "INT_MIN" cannot be represented by a signed 32-bit integer, calling abs(INT_MIN) results in signed integer overflow and undefined behavior. An attacker can trigger the issue by supplying a specially crafted BMP file whose height field is set to 0x80000000. Under UBSan configurations with halt_on_error enabled, processing such a file causes the image decoder process to abort, resulting in a denial of service. In non-sanitized release builds, the behavior is compiler-dependent due to the underlying undefined behavior.
More details: https://github.com/SerenityOS/serenity/issues/26957 |
|---|
| स्रोत | ⚠️ https://github.com/SerenityOS/serenity/issues/26957 |
|---|
| उपयोगकर्ता | cz_seuer (UID 100791) |
|---|
| सबमिशन | 25/08/2026 09:14 AM (26 दिन पहले) |
|---|
| संयम | 19/09/2026 07:40 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407958 [SerenityOS तक 3d83e4509fd20d7438e1ae8470ffe668c136229c LibGfx BMPLoader.cpp decode_bmp_pixel_data height बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|